Description
A stored cross-site scripting (XSS) vulnerability exists in in Magento 1 prior to 1.9.4.3 and 1.14.4.3, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with access to the wysiwyg editor can abuse the blockDirective() function and inject malicious javascript in the cache of the admin dashboard.
Analysis
No analysis available yet.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Adobe Systems Incorporated | Magento 1 & 2 | affected |
|
Configuration 1 [-]
|
No data.
No data available yet.
Remediation
No remediation available yet.
Tracking
Sign in to view the affected projects.
Advisories
| Source | ID | Title |
|---|---|---|
 EUVD |
EUVD-2022-4390 | A stored cross-site scripting (XSS) vulnerability exists in in Magento 1 prior to 1.9.4.3 and 1.14.4.3, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with access to the wysiwyg editor can abuse the blockDirective() function and inject malicious javascript in the cache of the admin dashboard. |
 Github GHSA |
GHSA-jjmg-xmq2-g6ff | Magento 2 Community Edition XSS Vulnerability |
References
| Link | Providers |
|---|---|
| https://magento.com/security/patches/supee-11219 |
|
History
No history.
MITRE
Status: PUBLISHED
Assigner: adobe
Published:
Updated: 2024-08-04T21:10:33.108Z
Reserved: 2019-02-12T00:00:00.000Z
Link: CVE-2019-8152
Vulnrichment
No data.
NVD
Status : Modified
Published: 2019-11-06T00:15:12.577
Modified: 2026-06-17T02:41:34.763
Link: CVE-2019-8152
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses
-
CWE-79
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')