CVE-2019-7938
CVE-2019-7938
This page contains facts from public vulnerability sources. Check the original advisory before updating.
A stored cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with privileges to modify catalog price rules to inject malicious javascript.
CVSS 4.8 · Medium · EPSS 0.6% · Fix available
- Published
- Updated
Stack: php
Affected products and versions
magento 1 magento 2
- Versions
- Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2: Affected
No fix published
magento/community-edition Packagist
- Versions
- 2.1.0
- 2.1.1
- 2.1.10
- 2.1.11
- 2.1.12
- 2.1.13
- 2.1.14
- 2.1.15
- 2.1.16
- 2.1.17
- 2.1.2
- 2.1.3
- 2.1.4
- 2.1.5
- 2.1.6
- 2.1.7
- 2.1.8
- 2.1.9
- Affected ranges
- ECOSYSTEM: ≥ 2.1.0, < 2.1.18
Update to 2.1.18
magento/community-edition Packagist
- Versions
- 2.2.0
- 2.2.1
- 2.2.2
- 2.2.3
- 2.2.4
- 2.2.5
- 2.2.6
- 2.2.7
- 2.2.8
- Affected ranges
- ECOSYSTEM: ≥ 2.2.0, < 2.2.9
Update to 2.2.9
magento/community-edition Packagist
- Versions
- 2.3.0
- 2.3.1
- Affected ranges
- ECOSYSTEM: ≥ 2.3.0, < 2.3.2
Update to 2.3.2
magento/magento1ce Packagist
- Affected ranges
- ECOSYSTEM: ≥ 1, < 1.9.4.2
Update to 1.9.4.2
magento/magento1ee Packagist
- Affected ranges
- ECOSYSTEM: ≥ 1, < 1.14.4.2
Update to 1.14.4.2
magento/product-community-edition Packagist
- Affected ranges
- ECOSYSTEM: ≥ 2.1, < 2.1.18
Update to 2.1.18
magento/product-community-edition Packagist
- Affected ranges
- ECOSYSTEM: ≥ 2.2, < 2.2.9
Update to 2.2.9
magento/product-community-edition Packagist
- Affected ranges
- ECOSYSTEM: ≥ 2.3, < 2.3.2
Update to 2.3.2