Description

A stored cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with privileges to edit newsletter templates to inject malicious javascript.

Remediation

References

CVE-2019-7934

Related Vulnerabilities

WordPress Plugin Additional Variation Images for WooCommerce Cross-Site Scripting (1.1.28)

WordPress Plugin Portfolio Slideshow Cross-Site Scripting (1.13.0)

osCommerce Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2023-43731)

WordPress Plugin Import any XML or CSV File to WordPress Cross-Site Scripting (3.6.2)

WordPress Plugin IBPS Online Exam Multiple Vulnerabilities (1.0)

Severity

Medium

Classification

CVE-2019-7934 CWE-707 CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

Tags

Missing Update Known Vulnerabilities