Description

A cross-site scripting mitigation bypass exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user to escalate privileges (admin vs. admin XSS attack).

Remediation

References

CVE-2019-7881

Related Vulnerabilities

Ext JS Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2018-8046)

MySQL CVE-2024-20985 Vulnerability (CVE-2024-20985)

WordPress Plugin WordPress Simple Ecommerce Shopping Cart-Sell products through Paypal Arbitrary File Upload (2.2.5)

WordPress Plugin RSS for Yandex Turbo Cross-Site Scripting (1.29)

TYPO3 Improper Input Validation Vulnerability (CVE-2013-7079)

Severity

Medium

Classification

CVE-2019-7881 CWE-707 CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Tags

Missing Update Known Vulnerabilities