Description

A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can be exploited by an authenticated user with permissions to manage tax rules.

Remediation

References

CVE-2019-7868

Related Vulnerabilities

Oracle Database Server CVE-2015-2586 Vulnerability (CVE-2015-2586)

Sqlite Improper Handling of Exceptional Conditions Vulnerability (CVE-2019-19924)

WebLogic Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2022-21371)

MongoDb Improper Input Validation Vulnerability (CVE-2019-2389)

WordPress Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2011-0701)

Severity

Medium

Classification

CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Tags

Missing Update Known Vulnerabilities CWE-707 CVE-2019-7868