PT-2019-18947 · Adobe · Magento

Published 2019-11-05 · Updated 2019-11-12 · CVE-2019-8233

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Magento 2.2 versions prior to 2.2.10 Magento 2.3 versions prior to 2.3.3 or 2.3.2-p1

Description The issue allows an unauthenticated user to inject arbitrary JavaScript code due to the sanitization engine ignoring HTML comments.

Recommendations For Magento 2.2, update to version 2.2.10 or later. For Magento 2.3, update to version 2.3.3 or 2.3.2-p1 or later.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2019-8233

GHSA-FM68-89M8-4GJJ

Affected Products

Magento

References · 6

• https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-8233 · Security Note
• https://osv.dev/vulnerability/CVE-2019-8233 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-fm68-89m8-4gjj · Vendor Advisory
• https://github.com/magento/magento2 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-8233 · Note