Improper Neutralization of Special Elements in Output Used by a Downstream Component in Magento Open Source - CVE-2019-7889
Published: August 3, 2019 / Updated: July 17, 2020
Vulnerability identifier: #VU30908
CSH Severity: Medium
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-7889
CWE-ID: CWE-74
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote authenticated user to manipulate data.
An injection vulnerability exists in Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with marketing manipulation privileges can invoke methods that alter data of the underlying model followed by corresponding database modifications.
Affected software
Magento Open Source
How to mitigate CVE-2019-7889
Install update from vendor's website.
Magento Open Source - update to 2.3.2