Description

A reflected cross-site scripting vulnerability exists in the Product widget chooser functionality in the admin panel for Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2.

Remediation

References

CVE-2019-7862

Related Vulnerabilities

IBM RTC Incorrect Authorization Vulnerability (CVE-2017-1700)

Apache Tomcat Improper Encoding or Escaping of Output Vulnerability (CVE-2025-31651)

Liferay Portal Allocation of Resources Without Limits or Throttling Vulnerability (CVE-2024-26265)

WordPress Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2020-28038)

WordPress Plugin Easy Social Icons Cross-Site Scripting (3.0.8)

Severity

Medium

Classification

CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Tags

Missing Update Known Vulnerabilities CWE-707 CVE-2019-7862