CVE-2019-7944: XSS
First published: Tue Jun 25 2019(Updated: )
A stored cross-site scripting vulnerability exists in the product comments field of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with privileges to the Return Product comments field can inject malicious javascript.
Credit: psirt@adobe.com psirt@adobe.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| composer/magento/magento1ee | >=1<1.14.4.2 | |
| composer/magento/magento1ce | >=1<1.9.4.2 | |
| composer/magento/product-community-edition | >=2.1<2.1.18>=2.2<2.2.9>=2.3<2.3.2 | |
| composer/magento/community-edition | >=2.3.0<2.3.2 | 2.3.2 |
| composer/magento/community-edition | >=2.2.0<2.2.9 | 2.2.9 |
| composer/magento/community-edition | >=2.1.0<2.1.18 | 2.1.18 |
| Magento | <1.9.4.2 | |
| Magento | <1.14.4.2 | |
| Magento | >=2.1.0<2.1.18 | |
| Magento | >=2.2.0<2.2.9 | |
| Magento | >=2.3.0<2.3.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23
- https://nvd.nist.gov/vuln/detail/CVE-2019-7944
- https://web.archive.org/web/20220127030535/https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-24
- https://github.com/advisories/GHSA-3mxq-v9rw-m6x9 (Advisory)
- https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-24
- https://github.com/FriendsOfPHP/security-advisories/blob/master/magento/magento1ce/CVE-2019-7944.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/magento/magento1ee/CVE-2019-7944.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/magento/product-community-edition/CVE-2019-7944.yaml
Frequently Asked Questions
What is the severity of CVE-2019-7944?
CVE-2019-7944 is categorized as a stored cross-site scripting vulnerability.
How do I fix CVE-2019-7944?
To mitigate CVE-2019-7944, update your Magento instance to versions 1.9.4.2, 1.14.4.2, 2.1.18, 2.2.9, or 2.3.2.
What versions of Magento are affected by CVE-2019-7944?
Magento Open Source versions prior to 1.9.4.2, Magento Commerce prior to 1.14.4.2, and Magento 2.1 versions prior to 2.1.18 and so on are affected.
Who can exploit CVE-2019-7944?
An authenticated user with privileges to the Return Product feature can exploit CVE-2019-7944.
What kind of impact does CVE-2019-7944 have?
CVE-2019-7944 allows attackers to execute malicious scripts on users' browsers, potentially leading to data theft or session hijacking.
- collector/friends-of-php
- agent/author
- agent/type
- agent/first-publish-date
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-3mxq-v9rw-m6x9
- alias/CVE-2019-7944
- agent/software-canonical-lookup
- agent/severity
- agent/references
- agent/weakness
- agent/description
- collector/github-advisory
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/event
- agent/trending
- agent/source
- agent/tags
- collector/nvd-cve
- source/NVD
- agent/software-canonical-lookup-request
- collector/nvd-index
- agent/softwarecombine
- package-manager/composer
- vendor/magento
- canonical/magento
- version/magento/2.1.0
- version/magento/2.2.0
- version/magento/2.3.0