GHSA-mgfr-44wv-hqv6

Source

https://github.com/advisories/GHSA-mgfr-44wv-hqv6

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-mgfr-44wv-hqv6/GHSA-mgfr-44wv-hqv6.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-mgfr-44wv-hqv6

Aliases

CVE-2019-7938

Published

2022-05-24T16:52:28Z

Modified

2024-02-16T08:13:39.410595Z

Severity

4.8 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N CVSS Calculator

Summary

Magento 2 Community Edition XSS Vulnerability

Details

A stored cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with privileges to modify catalog price rules to inject malicious javascript.

Database specific

{
    "nvd_published_at": "2019-08-02T22:15:00Z",
    "cwe_ids": [
        "CWE-79"
    ],
    "severity": "MODERATE",
    "github_reviewed": true,
    "github_reviewed_at": "2023-07-14T23:09:44Z"
}

References

Affected packages

Packagist / magento/community-edition

Package

Name: magento/community-edition
Purl: pkg:composer/magento/community-edition

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.1.0

Fixed

2.1.18

Affected versions

2.*

2.1.0

2.1.1

2.1.2

2.1.3

2.1.4

2.1.5

2.1.6

2.1.7

2.1.8

2.1.9

2.1.10

2.1.11

2.1.12

2.1.13

2.1.14

2.1.15

2.1.16

2.1.17

Packagist / magento/community-edition

Package

Name: magento/community-edition
Purl: pkg:composer/magento/community-edition

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.2.0

Fixed

2.2.9

Affected versions

2.*

2.2.0

2.2.1

2.2.2

2.2.3

2.2.4

2.2.5

2.2.6

2.2.7

2.2.8

Packagist / magento/community-edition

Package

Name: magento/community-edition
Purl: pkg:composer/magento/community-edition

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.3.0

Fixed

2.3.2

Affected versions

2.*

2.3.0

2.3.1

Packagist / magento/magento1ce

Package

Name: magento/magento1ce
Purl: pkg:composer/magento/magento1ce

Affected ranges

Type: ECOSYSTEM
Events: Introduced

1

Fixed

1.9.4.2

Packagist / magento/magento1ee

Package

Name: magento/magento1ee
Purl: pkg:composer/magento/magento1ee

Affected ranges

Type: ECOSYSTEM
Events: Introduced

1

Fixed

1.14.4.2

Packagist / magento/product-community-edition

Package

Name: magento/product-community-edition
Purl: pkg:composer/magento/product-community-edition

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.1

Fixed

2.1.18

Packagist / magento/product-community-edition

Package

Name: magento/product-community-edition
Purl: pkg:composer/magento/product-community-edition

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.2

Fixed

2.2.9

Packagist / magento/product-community-edition

Package

Name: magento/product-community-edition
Purl: pkg:composer/magento/product-community-edition

Affected ranges

Type: ECOSYSTEM
Events: Introduced

2.3

Fixed

2.3.2