CVE-2019-7850: PRODSECBUG-2116: Stored cross-site scripting in the catalog events feature
Adobe Campaign Classic version 18.10.5-8984 and earlier versions have a Command injection vulnerability. Successful exploitation could lead to Arbitrary Code Execution in the context of the current user.
Other sources
PRODSECBUG-2116: Stored cross-site scripting in the catalog events feature
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/magento/product-community-editionto a version that resolves this vulnerability.Fixed in 2.1.18 - Upgrade
Upgrade
composer/magento/product-community-editionto a version that resolves this vulnerability.Fixed in 2.2.9 - Upgrade
Upgrade
composer/magento/product-community-editionto a version that resolves this vulnerability.Fixed in 2.3.2
Event History
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2019-7850.
What is the title of the vulnerability?
The title of the vulnerability is PRODSECBUG-2116: Stored cross-site scripting in the catalog events feature.
What is the affected software?
The affected software is Adobe Campaign Classic version 18.10.5-8984 and earlier versions.
What is the severity of CVE-2019-7850?
The severity of CVE-2019-7850 is critical with a severity value of 9.8.
How do I fix CVE-2019-7850?
To fix CVE-2019-7850, you should patch your software to the latest version provided by the vendor.