CVE-2019-7927: XSS
First published: Tue Jun 25 2019(Updated: )
A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with privileges to edit product content pages to inject malicious javascript.
Credit: psirt@adobe.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| composer/magento/product-community-edition | >=2.1<2.1.18>=2.2<2.2.9>=2.3<2.3.2 | |
| composer/magento/community-edition | >=2.3.0<2.3.2 | 2.3.2 |
| composer/magento/community-edition | >=2.2.0<2.2.9 | 2.2.9 |
| composer/magento/community-edition | >=2.1.0<2.1.18 | 2.1.18 |
| CentOS Libgcc | >=2.1.0<2.1.18 | |
| CentOS Libgcc | >=2.2.0<2.2.9 | |
| CentOS Libgcc | >=2.3.0<2.3.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13
- https://nvd.nist.gov/vuln/detail/CVE-2019-7927
- https://web.archive.org/web/20211206084839/https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13
- https://github.com/advisories/GHSA-r68f-45jg-64m6 (Advisory)
- https://github.com/FriendsOfPHP/security-advisories/blob/master/magento/product-community-edition/CVE-2019-7927.yaml
Frequently Asked Questions
What is the severity of CVE-2019-7927?
CVE-2019-7927 is classified as a stored cross-site scripting vulnerability with a medium severity that affects Magento versions prior to 2.1.18, 2.2.9, and 2.3.2.
How do I fix CVE-2019-7927?
To fix CVE-2019-7927, you should update your Magento installation to version 2.1.18, 2.2.9, or 2.3.2.
Who is affected by CVE-2019-7927?
CVE-2019-7927 affects authenticated users of Magento versions prior to 2.1.18, 2.2.9, and 2.3.2 with privileges to edit product content pages.
What can an attacker do with CVE-2019-7927?
An attacker exploiting CVE-2019-7927 can inject malicious JavaScript into product content pages through the admin panel.
Is CVE-2019-7927 a critical vulnerability?
CVE-2019-7927 is not classified as critical but poses a significant security risk, especially if exploited in a production environment.
- collector/friends-of-php
- agent/type
- agent/first-publish-date
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-r68f-45jg-64m6
- alias/CVE-2019-7927
- agent/software-canonical-lookup
- agent/weakness
- agent/severity
- agent/references
- agent/description
- collector/github-advisory
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/event
- agent/trending
- agent/source
- agent/author
- agent/softwarecombine
- agent/tags
- collector/nvd-cve
- source/NVD
- agent/software-canonical-lookup-request
- collector/nvd-index
- package-manager/composer
- vendor/magento
- canonical/centos libgcc
- version/centos libgcc/2.1.0
- version/centos libgcc/2.2.0
- version/centos libgcc/2.3.0