Description

A stored cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can inject arbitrary JavaScript code via title of an order when configuring sales payment methods for a store.

Remediation

References

CVE-2019-8142

Related Vulnerabilities

WordPress Plugin Leaflet Maps Marker (Google Maps, OpenStreetMap, Bing Maps) Multiple Cross-Site Scripting Vulnerabilities (3.9.8)

WordPress Plugin Thrive Themes Builder Security Bypass (2.2.3)

WordPress Plugin Wholesale Market for WooCommerce Arbitrary File Download (1.0.7)

WordPress Plugin HT Slider Range for Amazon affiliates Cross-Site Scripting (1.1.5)

WordPress Plugin Custom Dashboard & Login Page-AGCA Multiple Unspecified Vulnerabilities (1.5.4.2)

Severity

Medium

Classification

CVE-2019-8142 CWE-707 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Tags

Missing Update Known Vulnerabilities