Description

Samples of disabled downloadable products are accessible in Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 due to inadequate validation of user input.

Remediation

References

CVE-2019-7898

Related Vulnerabilities

WordPress Plugin WP Ajax Recent Posts 'number' Parameter Cross-Site Scripting (1.0.1)

WordPress Plugin Fancy Gallery 'image-upload.php' Arbitrary File Upload (1.2.4)

WordPress Plugin Daily Inspiration Generator Cross-Site Scripting (2.0)

IBM RTC Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2017-1653)

WordPress Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2019-16222)

Severity

Medium

Classification

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Tags

Missing Update Known Vulnerabilities CWE-20 CVE-2019-7898