GHSA-j49x-jjmj-9fqj

Suggest an improvement
Source
https://github.com/advisories/GHSA-j49x-jjmj-9fqj
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-j49x-jjmj-9fqj/GHSA-j49x-jjmj-9fqj.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-j49x-jjmj-9fqj
Aliases
  • CVE-2019-8227
Published
2022-05-24T17:00:29Z
Modified
2024-01-11T15:09:06Z
Severity
  • 4.8 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N CVSS Calculator
Summary
Magento XSS Vulnerability
Details

In Magento prior to 1.9.4.3 and Magento prior to 1.14.4.3, an authenticated user with limited administrative privileges can inject arbitrary JavaScript code via import / export functionality when creating profile action XML.

Database specific
{
    "nvd_published_at": "2019-11-06T00:15:00Z",
    "cwe_ids": [
        "CWE-79"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2023-07-18T19:50:49Z"
}
References

Affected packages

Packagist / magento/core

Package

Name
magento/core
Purl
pkg:composer/magento/core

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
1.9.4.3