CVE-2019-8139: XSS

Q: What is the severity of CVE-2019-8139?

CVE-2019-8139 is classified as a stored cross-site scripting (XSS) vulnerability, which can lead to the execution of arbitrary JavaScript code.

Q: How do I fix CVE-2019-8139?

To remediate CVE-2019-8139, upgrade to Magento version 2.3.2-p1 or 2.2.10.

Q: Who is affected by CVE-2019-8139?

CVE-2019-8139 affects users of Magento 2.3 versions prior to 2.3.3 and 2.2 versions prior to 2.2.10.

Q: What can an attacker do with CVE-2019-8139?

An attacker can exploit CVE-2019-8139 to inject and execute arbitrary JavaScript in the context of an authenticated user's session.

Q: Is this vulnerability unique to Magento?

Yes, CVE-2019-8139 specifically affects the Magento platform and its versions mentioned.

Published Oct 8, 2019

Updated

A stored cross-site scripting (XSS) vulnerability exists in Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can inject arbitrary Javascript code into the dynamic block when invoking page builder on a product.

Other sources

PRODSECBUG-2410: Cross-Site Scripting via Dynamic block in the Page builder

Affected Software

7 affected componentsFixes available

composer/magento/product-community-edition>=2.2, <2.2.10, >=2.3, <2.3.2-p2

composer/magento/community-edition>=2.3.0<2.3.2-p1

2.3.2-p1

composer/magento/community-edition>=2.2.0<2.2.10

2.2.10

Magento Magento>=2.3.0<2.3.2

Magento Magento=2.3.2

Remediation

Patch Available

https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update

Event History

Oct 8, 2019

Advisory Published

12:00 AM

Nov 5, 2019

CVE Published

via MITRE·11:23 PM

Data Sourced

via MITRE·11:23 PM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2019-8139?