CVE-2019-7882
published 2019-08-02CVE-2019-7882: A stored cross-site scripting vulnerability exists in the WYSIWYG editor of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2…
PriorityP425medium5.4CVSS 3.0
AVNACLPRLUIRSCCLILAN
EPSS
0.57%
42.8th percentile
A stored cross-site scripting vulnerability exists in the WYSIWYG editor of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with privileges to the editor can inject malicious SWF files.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| magento | community-edition | >= 2.1 < 2.1.18 | 2.1.18 |
| magento | community-edition | >= 2.2 < 2.2.9 | 2.2.9 |
| magento | community-edition | >= 2.3 < 2.3.2 | 2.3.2 |
| magento | magento | < 1.9.4.2 | 1.9.4.2 |
| magento | magento | < 1.14.4.2 | 1.14.4.2 |
| magento | magento | >= 2.1.0 < 2.1.18 | 2.1.18 |
| magento | magento | >= 2.2.0 < 2.2.9 | 2.2.9 |
| magento | magento | >= 2.3.0 < 2.3.2 | 2.3.2 |
CVSS provenance
nvdv3.05.4MEDIUMCVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
nvdv2.03.5LOWAV:N/AC:M/Au:S/C:N/I:P/A:N
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Magento 2 Community Edition XSS Vulnerability
ghsa·2022-05-24
CVE-2019-7882 [MEDIUM] CWE-79 Magento 2 Community Edition XSS Vulnerability
Magento 2 Community Edition XSS Vulnerability
A stored cross-site scripting vulnerability exists in the WYSIWYG editor of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with privileges to the editor can inject malicious SWF files.
OSV
Magento 2 Community Edition XSS Vulnerability
osv·2022-05-24
CVE-2019-7882 [MEDIUM] Magento 2 Community Edition XSS Vulnerability
Magento 2 Community Edition XSS Vulnerability
A stored cross-site scripting vulnerability exists in the WYSIWYG editor of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with privileges to the editor can inject malicious SWF files.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2019-08-02
Published