Description

An information disclosure vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with privileges to create email templates could leak sensitive data via a malicious email template.

Remediation

References

CVE-2019-7888

Related Vulnerabilities

WordPress Plugin WP-Polls SQL Injection (2.71)

WordPress Plugin Claptastic Clap! Button Multiple Cross-Site Scripting Vulnerabilities (1.3)

Joomla Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2013-5583)

WordPress Plugin wpDataTables-WordPress Tables & Table Charts Multiple Cross-Site Scripting Vulnerabilities (2.1.27)

Internet Information Services Other Vulnerability (CVE-2000-0886)

Severity

Medium

Classification

CVE-2019-7888 CWE-200 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Tags

Missing Update Known Vulnerabilities