CVE-2019-7937: XSS
A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with privileges to store product attributes to inject malicious javascript.
Other sources
PRODSECBUG-2366: Stored cross-site scripting in the admin panel
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-7937?
CVE-2019-7937 has a medium severity rating due to its potential for exploitation through stored cross-site scripting.
How do I fix CVE-2019-7937?
To fix CVE-2019-7937, update your Magento version to 2.1.18, 2.2.9, or 2.3.2 or later.
Who is affected by CVE-2019-7937?
CVE-2019-7937 affects authenticated users of Magento 2.1 prior to 2.1.18, 2.2 prior to 2.2.9, and 2.3 prior to 2.3.2.
What type of vulnerability is CVE-2019-7937?
CVE-2019-7937 is a stored cross-site scripting (XSS) vulnerability.
Can exploited CVE-2019-7937 lead to data breaches?
Yes, exploitation of CVE-2019-7937 could potentially allow attackers to inject malicious JavaScript, leading to data theft or other attacks.