Lucene search

GitHub Advisory DatabaseGHSA-77MV-P94F-QCQ4

HistoryMay 24, 2022 - 4:52 p.m.

Magento 2 Community Edition XSS Vulnerability

2022-05-2416:52:28

CWE-79

GitHub Advisory Database

github.com

magento

cross-site scripting

vulnerability

admin panel

open source

commerce

authenticated user

privileges

malicious javascript

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

4.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

27.3%

JSON

A stored cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with privileges to edit newsletter templates to inject malicious javascript.

Affected configurations

Vulners

Node

magentocommunity-editionRange2.3.0–2.3.2

magentocommunity-editionRange2.2.0–2.2.9

magentocommunity-editionRange2.1.0–2.1.18

VendorProductVersionCPE
magentocommunity-edition*cpe:2.3:a:magento:community-edition:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
magento	community-edition	*	cpe:2.3:a:magento:community-edition::::::::

References

github.com/advisories/GHSA-77mv-p94f-qcq4

github.com/FriendsOfPHP/security-advisories/blob/master/magento/magento1ce/CVE-2019-7934.yaml

github.com/FriendsOfPHP/security-advisories/blob/master/magento/magento1ee/CVE-2019-7934.yaml

github.com/FriendsOfPHP/security-advisories/blob/master/magento/product-community-edition/CVE-2019-7934.yaml

magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23

nvd.nist.gov/vuln/detail/CVE-2019-7934

web.archive.org/web/20220121051916/https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23

CVSS2

3.5

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

CVSS3

4.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N

EPSS

0.001

Percentile

27.3%

JSON

Related for GHSA-77MV-P94F-QCQ4