CVE-2019-7944: XSS
A stored cross-site scripting vulnerability exists in the product comments field of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with privileges to the Return Product comments field can inject malicious javascript.
Other sources
PRODSECBUG-2378: Stored cross-site scripting in the Return Product comments feature
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-7944?
CVE-2019-7944 is categorized as a stored cross-site scripting vulnerability.
How do I fix CVE-2019-7944?
To mitigate CVE-2019-7944, update your Magento instance to versions 1.9.4.2, 1.14.4.2, 2.1.18, 2.2.9, or 2.3.2.
What versions of Magento are affected by CVE-2019-7944?
Magento Open Source versions prior to 1.9.4.2, Magento Commerce prior to 1.14.4.2, and Magento 2.1 versions prior to 2.1.18 and so on are affected.
Who can exploit CVE-2019-7944?
An authenticated user with privileges to the Return Product feature can exploit CVE-2019-7944.
What kind of impact does CVE-2019-7944 have?
CVE-2019-7944 allows attackers to execute malicious scripts on users' browsers, potentially leading to data theft or session hijacking.