PT-2019-18929 · Adobe · Magento

Publicado 2019-11-05 · Atualizado 2022-05-24 · CVE-2019-8153

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Magento 2.2 versions prior to 2.2.10 Magento 2.3 versions prior to 2.3.3 Magento 2.3 version 2.3.2-p1

Description A mitigation bypass to prevent cross-site scripting (XSS) exists, allowing an attacker to bypass the escapeURL() function and execute a malicious XSS payload.

Recommendations For Magento 2.2 versions prior to 2.2.10, upgrade to version 2.2.10 or later. For Magento 2.3 versions prior to 2.3.3, upgrade to version 2.3.3 or later. For Magento 2.3 version 2.3.2-p1, upgrade to version 2.3.2-p2.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2019-8153

GHSA-273R-V888-VGC6

Produtos afetados

Magento

Referências · 9

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/magento/product-community-edition/CVE-2019-8153.yaml · Exploit
• https://github.com/magento/magento2 · Nota
• https://github.com/magento/magento2/commit/c6ab7ac38f25309318e5819d4bdd936b2a0cf6bd · Nota
• https://github.com/magento/magento2/commit/f5eb758c12a2c40ba3fe38ce44b46192494f4ff8 · Nota
• https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-8153 · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-273r-v888-vgc6 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-8153 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-8153 · Nota