p PatchFirst

CVE-2019-8153

CVE-2019-8153

This page contains facts from public vulnerability sources. Check the original advisory before updating.

A mitigation bypass to prevent cross-site scripting (XSS) exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. Successful exploitation of this vulnerability would result in an attacker being able to bypass the `escapeURL()` function and execute a malicious XSS payload.

CVSS 6.1 · Medium · EPSS 1.5% · Fix available

Published
Updated

Stack: php

Affected products and versions

  • magento 2

    Versions
    • Magento 2.2 prior to 2.2.10: Affected
    • Magento 2.3 prior to 2.3.3 or 2.3.2-p1: Affected

    No fix published

  • magento/community-edition Packagist

    Versions
    • 2.2.0
    • 2.2.1
    • 2.2.2
    • 2.2.3
    • 2.2.4
    • 2.2.5
    • 2.2.6
    • 2.2.7
    • 2.2.8
    • 2.2.9
    Affected ranges
    • ECOSYSTEM: ≥ 2.2.0, < 2.2.10

    Update to 2.2.10

  • magento/community-edition Packagist

    Versions
    • 2.3.0
    • 2.3.1
    • 2.3.2
    Affected ranges
    • ECOSYSTEM: ≥ 2.3.0, < 2.3.2-p2

    Update to 2.3.2-p2

Original sources

Check your server →