Description
A stored cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can execute arbitrary JavaScript code by providing arbitrary API endpoint that will not be chcecked by sale pickup event.
Remediation
References
Related Vulnerabilities
Internet Information Services Other Vulnerability (CVE-2002-0071)
WordPress Plugin W4 Post List Multiple Vulnerabilities (2.4.5)
Nginx Out-of-bounds Read Vulnerability (CVE-2023-27730)
WordPress Plugin WordPress Download Manager Arbitrary File Upload (2.8.97)
WordPress Plugin RocketTheme RokBox 'jwplayer.swf' Cross-Site Scripting (2.11)