CVE-2019-7908: Magento Cross-site Scripting in the admin panel
Summary
CVE-2019-7908: Magento Cross-site Scripting in the admin panel. Affects magento/community-edition across 3 version ranges.
>= 2.1.0, < 2.1.18
>= 2.2.0, < 2.2.9
>= 2.3.0, < 2.3.2
Fixed in 2.1.18, 2.2.9 or 2.3.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Magento is an open-source e-commerce platform that allows businesses to create and manage online stores. It provides a wide range of features for product management, order processing, and customer engagement. However, Magento versions 2.1 prior to 2.1.18, 2.2 prior to 2.2.9, and 2.3 prior to 2.3.2 are vulnerable to a stored cross-site scripting (XSS) attack in the admin panel. This vulnerability can be exploited by an authenticated user with privileges to modify product information.
Vulnerability Detail
The stored XSS vulnerability in Magento's admin panel allows an attacker to inject malicious scripts into the application, which are then executed when viewed by other users. This can lead to various attacks, such as stealing sensitive information, session hijacking, or performing actions on behalf of the victim. The vulnerability originates from insufficient input sanitization and validation in the product information modification functionality.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.1.0, < 2.1.182.1.18composer require magento/community-edition:2.1.18 -
>= 2.2.0, < 2.2.92.2.9composer require magento/community-edition:2.2.9 -
>= 2.3.0, < 2.3.22.3.2composer require magento/community-edition:2.3.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If immediate patching is not possible, a temporary workaround is to restrict access to the admin panel only to trusted users and implement a web application firewall (WAF) to filter out malicious script injections. Additionally, educating users about the risks of clicking on untrusted links or opening suspicious attachments can help mitigate the impact of this vulnerability.
Conclusion
The stored cross-site scripting vulnerability in Magento's admin panel can have serious consequences if left unpatched. It is crucial for Magento users to upgrade to the latest patched versions and implement additional security measures to protect against potential attacks. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for magento/community-edition →
FAQ
The vulnerability allows an attacker to execute arbitrary scripts in the context of other users, potentially leading to unauthorized actions, data theft, or session hijacking.
An authenticated user with privileges to modify product information can exploit this vulnerability.
There have been reported instances of this vulnerability being exploited in the wild, highlighting the importance of applying the necessary patches.
No, this vulnerability requires an authenticated user to exploit it. However, if an attacker gains access to a valid user account, they can exploit the vulnerability remotely.
Yes, the CVSS score for this vulnerability is 4.8, indicating a moderate severity level.
Related vulnerabilities
Recent vulnerabilities recorded for magento/community-edition.
