Description
A stored cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can craft malicious payload in the template Name field for Email template in the "Design Configuration" dashboard.
Remediation
References
Related Vulnerabilities
Zikula Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2014-2293)
Nginx Integer Overflow or Wraparound Vulnerability (CVE-2017-20005)
PostgreSQL Resource Management Errors Vulnerability (CVE-2012-2655)
WordPress Plugin Monetize Multiple Vulnerabilities (1.03)
WordPress Plugin Digital Publications by Supsystic Multiple Vulnerabilities (1.6.9)