Description

A stored cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with privileges to newsletter templates.

Remediation

References

CVE-2019-7875

Related Vulnerabilities

WordPress Plugin Church Admin 'id' Parameter Cross-Site Scripting (0.33.4.5)

Apache Tomcat Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') Vulnerability (CVE-2018-8037)

Sqlite Use After Free Vulnerability (CVE-2020-11656)

WordPress Improper Input Validation Vulnerability (CVE-2016-9263)

WordPress Plugin wpForo Forum SQL Injection (1.4.9)

Severity

Medium

Classification

CVE-2019-7875 CWE-707 CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Tags

Missing Update Known Vulnerabilities