Cross site scripting

2019-08-0222:15:00

PRIOn knowledge base

www.prio-n.com

0.001 Low

EPSS

Percentile

38.6%

JSON

A reflected cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 when the feature that adds a secret key to the Admin URL is disabled.

CPENameOperatorVersion
magentoge2.1.0
magentolt2.1.18
magentoge2.2.0
magentolt2.2.9
magentoge2.3.0
magentolt2.3.2
magentolt1.14.4.2
magentolt1.9.4.2

Name	Operator	Version
magento	ge	2.1.0
magento	lt	2.1.18
magento	ge	2.2.0
magento	lt	2.2.9
magento	ge	2.3.0
magento	lt	2.3.2
magento	lt	1.14.4.2
magento	lt	1.9.4.2

References

magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23

0.001 Low

EPSS

Percentile

38.6%

JSON

Related for PRION:CVE-2019-7887