Magento 2 Community Edition XSS Vulnerability
Summary
CVE-2019-7945: Magento 2 Community Edition XSS Vulnerability. Affects magento/community-edition across 3 version ranges.
>= 2.1.0, < 2.1.18
>= 2.2.0, < 2.2.9
>= 2.3.0, < 2.3.2
Fixed in 2.1.18, 2.2.9 or 2.3.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Magento 2 Community Edition is an open-source e-commerce platform that provides a wide range of features for online stores. It is widely used for its flexibility, scalability, and extensive customization options. However, a stored cross-site scripting (XSS) vulnerability has been discovered in Magento Open Source versions prior to 1.9.4.2, Magento Commerce versions prior to 1.14.4.2, Magento 2.1 versions prior to 2.1.18, Magento 2.2 versions prior to 2.2.9, and Magento 2.3 versions prior to 2.3.2. This vulnerability allows an authenticated user with privileges to modify currency symbols to inject malicious JavaScript code.
Vulnerability Detail
The stored XSS vulnerability in Magento 2 Community Edition allows an attacker to inject malicious JavaScript code into the application. This can be done by exploiting the ability to modify currency symbols, which is a privilege granted to authenticated users. Once the code is injected, it can be executed in the context of other users visiting the affected pages, potentially leading to various attacks such as session hijacking, defacement, or theft of sensitive information. The vulnerability has a CVSS score of 5.4, indicating a moderate severity level.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.1.0, < 2.1.182.1.18composer require magento/community-edition:2.1.18 -
>= 2.2.0, < 2.2.92.2.9composer require magento/community-edition:2.2.9 -
>= 2.3.0, < 2.3.22.3.2composer require magento/community-edition:2.3.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is recommended to apply the official patches or update to the latest version of Magento as soon as possible.
Conclusion
The XSS vulnerability in Magento 2 Community Edition poses a moderate risk to affected installations. It is crucial to update to the latest version or apply the official patches to mitigate the risk. Following secure coding practices and input validation is also recommended to prevent similar vulnerabilities in the future. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for magento/community-edition →
FAQ
The vulnerability allows an attacker to execute arbitrary JavaScript code in the context of other users, potentially leading to various attacks such as session hijacking, defacement, or theft of sensitive information.
Magento Open Source versions prior to 1.9.4.2, Magento Commerce versions prior to 1.14.4.2, Magento 2.1 versions prior to 2.1.18, Magento 2.2 versions prior to 2.2.9, and Magento 2.3 versions prior to 2.3.2 are affected by this vulnerability.
Yes, patches are available for the affected versions of Magento. It is recommended to update to the latest version or apply the official patches.
There are no known public exploits for this vulnerability at the time of writing. However, it is important to apply the necessary updates or patches to mitigate the risk.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Simply upload your composer.lock file and it will provide real-time alerts for open-source vulnerabilities.
References
Related vulnerabilities
Recent vulnerabilities recorded for magento/community-edition.
