Description

A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can be exploited by an authenticated user with permissions to manage customer groups.

Remediation

References

CVE-2019-7869

Related Vulnerabilities

Internet Information Services Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2002-0422)

WordPress Plugin WP Smart Security PHP Object Injection (1.0)

WordPress Plugin Schema App Structured Data Unspecified Vulnerability (0.5.4)

WebLogic Missing Authentication for Critical Function Vulnerability (CVE-2026-60291)

Zope Web Application Server Cryptographic Issues Vulnerability (CVE-2012-6661)

Severity

Medium

Classification

CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Tags

Missing Update Known Vulnerabilities CWE-707 CVE-2019-7869