CVE-2019-19682: XSS

Published Dec 9, 2019

Updated

nopCommerce through 4.20 allows XSS in the SaveStoreMappings of the components \Presentation\Nop.Web\Areas\Admin\Controllers\NewsController.cs and \Presentation\Nop.Web\Areas\Admin\Controllers\BlogController.cs via Body or Full to Admin/News/NewsItemEdit/[id] Admin/Blog/BlogPostEdit/[id]. NOTE: the vendor reportedly considers this a "feature" because the affected components are an HTML content editor.

Affected Software

1 affected component

Nopcommerce NopCommerce=4.20

Event History

Dec 9, 2019

CVE Published

via MITRE·04:58 PM

Data Sourced

via MITRE·04:58 PM

Description

Frequently Asked Questions

What is the severity of CVE-2019-19682?

CVE-2019-19682 is classified as a high severity vulnerability due to its potential for Cross-Site Scripting (XSS).

How do I fix CVE-2019-19682?

To fix CVE-2019-19682, upgrade to the latest version of nopCommerce that addresses this security flaw.

What components of nopCommerce are affected by CVE-2019-19682?

CVE-2019-19682 affects the NewsController and BlogController in nopCommerce version 4.20.

Can CVE-2019-19682 lead to data theft?

Yes, CVE-2019-19682 can lead to data theft by allowing an attacker to execute scripts in the context of the user's session.

Is CVE-2019-19682 a prevalent security issue in nopCommerce?

CVE-2019-19682 is a notable security issue in nopCommerce version 4.20, and it is important for users to address it promptly.