CVE-2019-7869: Magento Stored Cross-site Scripting vulnerability in the admin panel
Summary
CVE-2019-7869: Magento Stored Cross-site Scripting vulnerability in the admin panel. Affects magento/community-edition across 3 version ranges.
>= 2.1.0, < 2.1.18
>= 2.2.0, < 2.2.9
>= 2.3.0, < 2.3.2
Fixed in 2.1.18, 2.2.9 or 2.3.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Magento is an open-source e-commerce platform that provides merchants with a flexible shopping cart system and control over the look, content, and functionality of their online store. It is widely used by businesses to create and manage their e-commerce websites. However, Magento versions 2.1 prior to 2.1.18, 2.2 prior to 2.2.9, and 2.3 prior to 2.3.2 are vulnerable to a stored cross-site scripting (XSS) vulnerability in the admin panel. This vulnerability can be exploited by an authenticated user with permissions to manage customer groups.
Vulnerability Detail
The stored cross-site scripting vulnerability in the Magento admin panel allows an attacker to inject malicious code that will be stored and executed when a user with sufficient privileges accesses the affected page. This can lead to various security risks, including the theft of sensitive information, session hijacking, and unauthorized actions on behalf of the user. The vulnerability is rated as moderate with a CVSS score of 4.8.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.1.0, < 2.1.182.1.18composer require magento/community-edition:2.1.18 -
>= 2.2.0, < 2.2.92.2.9composer require magento/community-edition:2.2.9 -
>= 2.3.0, < 2.3.22.3.2composer require magento/community-edition:2.3.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended patch or upgrade to a fixed version of Magento to mitigate the risk.
Conclusion
In conclusion, the stored cross-site scripting vulnerability in the admin panel of Magento versions 2.1, 2.2, and 2.3 can be exploited by an authenticated user with permissions to manage customer groups. To mitigate this vulnerability, it is crucial to upgrade to the latest patched version of Magento or apply the recommended patch. For further assistance and support in vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for magento/community-edition →
FAQ
The vulnerability allows an authenticated user with permissions to manage customer groups to inject malicious code, potentially leading to the theft of sensitive information, session hijacking, and unauthorized actions.
Magento versions 2.1 prior to 2.1.18, 2.2 prior to 2.2.9, and 2.3 prior to 2.3.2 are affected by this vulnerability.
There is no known public exploit for this vulnerability at the time of this report. However, it is crucial to apply the recommended patch or upgrade to a fixed version to prevent potential exploitation.
The only effective mitigation is to apply the recommended patch or upgrade to a fixed version of Magento.
For more information about this vulnerability, you can refer to the official Magento security advisory and the GitHub advisory database.
Related vulnerabilities
Recent vulnerabilities recorded for magento/community-edition.
