#VU30660 Cross-site scripting in Magento Open Source - CVE-2019-8157

Vulnerability identifier: #VU30660

Vulnerability risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2019-8157

CWE-ID: CWE-79

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Magento Open Source
Web applications / E-Commerce systems

Vendor: Adobe

Description

The vulnerability allows a remote authenticated user to read and manipulate data.

A stored cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can manipulate downloadable link and cause an invocation of error handling that acceses user input without sanitization.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Magento Open Source: 2.3.0 - 2.3.1

---

External links
https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote authenticated user via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.