CVE-2019-8148: XSS
A stored cross-site scripting (XSS) vulnerability exists in Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated admin user can inject arbitrary JavaScript code when creating a content page via page builder.
Other sources
PRODSECBUG-2392: Cross-Site Scripting via PageBuilder Banner
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2019-8148?
CVE-2019-8148 is classified as a stored cross-site scripting (XSS) vulnerability that allows for arbitrary JavaScript code injection.
How do I fix CVE-2019-8148?
To fix CVE-2019-8148, update your Magento installation to version 2.3.3 or 2.3.2-p1 or later.
Who is affected by CVE-2019-8148?
CVE-2019-8148 affects Magento versions from 2.3.0 up to 2.3.2-p2 and versions of the product-community-edition up to 2.2.10.
Can CVE-2019-8148 be exploited remotely?
Yes, CVE-2019-8148 can be exploited by an authenticated admin user with access to the page builder.
Is there a patch for CVE-2019-8148?
Yes, Magento has released a security update and patch that addresses CVE-2019-8148 in the specified versions.