CVE-2019-8153: Magento Cross-site Scripting (XSS)
Summary
CVE-2019-8153: Magento Cross-site Scripting (XSS). Affects magento/community-edition across 2 version ranges.
>= 2.2.0, < 2.2.10
>= 2.3.0, < 2.3.2-p2
Fixed in 2.2.10 or 2.3.2-p2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Magento is an open-source e-commerce platform that provides a flexible and scalable solution for online businesses. It is widely used for creating and managing online stores. The vulnerability identified as CVE-2019-8153 affects Magento versions 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3, or 2.3.2-p1. This vulnerability allows an attacker to bypass the escapeURL() function, leading to the execution of a malicious cross-site scripting (XSS) payload.
Vulnerability Detail
The vulnerability arises due to a mitigation bypass in Magento's code. By exploiting this vulnerability, an attacker can inject and execute arbitrary JavaScript code on the affected Magento website. This can lead to various consequences, such as stealing sensitive user information, performing unauthorized actions on behalf of the user, or defacing the website. The vulnerability has a CVSS score of 6.1, indicating a moderate severity level.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.2.0, < 2.2.102.2.10composer require magento/community-edition:2.2.10 -
>= 2.3.0, < 2.3.2-p22.3.2-p2composer require magento/community-edition:2.3.2-p2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, website administrators can implement input validation and output encoding to prevent the execution of malicious scripts. This can be achieved by using security libraries or functions provided by the programming language used in the Magento installation. Here is an example of input validation and output encoding in PHP:
// Input validation
$input = $_GET['input'];
if (!preg_match('/^[a-zA-Z0-9]+$/', $input)) {
die('Invalid input');
}
// Output encoding
$output = htmlspecialchars($input, ENT_QUOTES, 'UTF-8');
echo $output;
Conclusion
The identified vulnerability in Magento allows for the execution of malicious cross-site scripting (XSS) payloads. It is crucial for website administrators to promptly upgrade their Magento installations to the latest version or apply the provided patch to mitigate the risk. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for magento/community-edition →
FAQ
Magento is an open-source e-commerce platform used for creating and managing online stores. It provides a flexible and scalable solution for businesses.
Cross-site scripting (XSS) is a type of security vulnerability that allows attackers to inject and execute malicious scripts on web pages viewed by other users.
This vulnerability allows an attacker to bypass the escapeURL() function in Magento, leading to the execution of a malicious XSS payload. This can result in various security risks, such as data theft or unauthorized actions on the affected website.
The CVSS score of this vulnerability is 6.1, indicating a moderate severity level.
To fix this vulnerability, it is recommended to upgrade Magento to the latest version or apply the provided patch specifically designed to address this issue.
References
Related vulnerabilities
Recent vulnerabilities recorded for magento/community-edition.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
