#VU30905 Cross-site scripting in Magento Open Source - CVE-2019-7882
Published: August 3, 2019 / Updated: July 17, 2020
Vulnerability identifier: #VU30905
Vulnerability risk: Low
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear
CVE-ID: CVE-2019-7882
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
Magento Open Source
Magento Open Source
Software vendor:
Adobe
Adobe
Description
The vulnerability allows a remote authenticated user to read and manipulate data.
A stored cross-site scripting vulnerability exists in the WYSIWYG editor of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with privileges to the editor can inject malicious SWF files.
Remediation
Install update from vendor's website.