Magento Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2019-7863)

Description

A stored cross-site scripting vulnerability exists in the admin panel for Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can be exploited by an authenticated user with access to products and categories.

Remediation

References

CVE-2019-7863

Related Vulnerabilities

Liferay Portal Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2019-16147)

PostgreSQL Other Vulnerability (CVE-1999-0862)

WordPress Plugin Content Control-User Access Restriction Cross-Site Scripting (1.1.9)

WordPress Plugin WP Floating Menu-One page navigator, sticky menu for WordPress Cross-Site Scripting (1.3.0)

WordPress Plugin Protected Posts Logout Button Security Bypass (1.4.5)

Severity

Medium

Classification

CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N