Cross site scripting

2019-11-0600:15:00

PRIOn knowledge base

www.prio-n.com

0.001 Low

EPSS

Percentile

27.3%

JSON

A stored cross-site scripting (XSS) vulnerability exists in in Magento 1 prior to 1.9.4.3 and 1.14.4.3, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with access to the wysiwyg editor can abuse the blockDirective() function and inject malicious javascript in the cache of the admin dashboard.

CPENameOperatorVersion
magentoge2.3.0
magentolt2.3.2
magentoge2.2.0
magentolt2.2.10
magentoge2.2.0
magentolt2.2.10
magentoge1.9.0.0
magentolt1.14.4.3
magentoge1.5.0.0
magentolt1.9.4.3

Name	Operator	Version
magento	ge	2.3.0
magento	lt	2.3.2
magento	ge	2.2.0
magento	lt	2.2.10
magento	ge	2.2.0
magento	lt	2.2.10
magento	ge	1.9.0.0
magento	lt	1.14.4.3
magento	ge	1.5.0.0
magento	lt	1.9.4.3

Rows per page:

1-10 of 141

References

magento.com/security/patches/supee-11219

0.001 Low

EPSS

Percentile

27.3%

JSON

Related for PRION:CVE-2019-8152