vulnwire
5.4med

CVE-2019-7945

Magento 2 Community Edition XSS Vulnerability

Also known as GHSA-c45w-p293-7cv6

Published 7 y ago · modified 4 mo ago · JSON

CVSS
5.4
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
0.6%
percentile 47%
Public exploits
0
none known

A stored cross-cite scripting vulnerability exists in Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with privileges to modify currency symbols can inject malicious javascript.

Exploit prediction (EPSS)

0.57% probability of exploitation in the next 30 days, higher than 47% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.05.4CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
NVD2.03.5AV:N/AC:M/Au:S/C:N/I:P/A:N
GitHub3.05.4CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Affected packages

EcosystemPackageAffectedFixed in
packagistmagento/community-edition
>=2.1.0, <2.1.18
>=2.2.0, <2.2.9
>=2.3.0, <2.3.2
2.1.18
2.2.9
2.3.2

Affected products

  • n/a Magento 1 Magento 2

Classification

Weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation

References

  • magento.com /security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23 · x_refsource_CONFIRM, x_transferred
  • nvd.nist.gov /vuln/detail/CVE-2019-7945 · advisory
  • github.com /FriendsOfPHP/security-advisories/blob/master/magento/magento1ce/CVE-2019-7945.yaml · web
  • github.com /FriendsOfPHP/security-advisories/blob/master/magento/magento1ee/CVE-2019-7945.yaml · web
  • github.com /FriendsOfPHP/security-advisories/blob/master/magento/product-community-edition/CVE-2019-7 · web
  • github.com /magento/magento2 · package
  • web.archive.org /web/20220121051916/https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-se · web

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.