Description

A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can be exploited by an authenticated user with access to edit Product information via the TinyMCE editor.

Remediation

References

CVE-2019-7866

Related Vulnerabilities

Joomla! Core 1.6.x Information Disclosure (1.6.0 - 1.6.6)

WordPress Plugin Download Monitor Cross-Site Scripting (3.3.6.1)

PostgreSQL Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2022-1552)

Oracle Application Server Credentials Management Errors Vulnerability (CVE-2002-2345)

WordPress Plugin FV Flowplayer Video Player Cross-Site Scripting (7.5.18.727)

Severity

Medium

Classification

CVE-2019-7866 CWE-707 CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N

Tags

Missing Update Known Vulnerabilities