CVE-2019-8152: XSS
A stored cross-site scripting (XSS) vulnerability exists in in Magento 1 prior to 1.9.4.3 and 1.14.4.3, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with access to the wysiwyg editor can abuse the blockDirective() function and inject malicious javascript in the cache of the admin dashboard.
As per the Magento Release 2.3.3, if you have already implemented the pre-release version of this patch (2.3.2-p1), it is highly recommended to promptly upgrade to 2.3.2-p2.
Other sources
A stored cross-site scripting (XSS) vulnerability exists in in Magento 1 prior to 1.9.4.3 and 1.14.4.3, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with access to the wysiwyg editor can abuse the blockDirective() function and inject malicious javascript in the cache of the admin dashboard.
PRODSECBUG-2344: Cross-Site Scripting via wysiwyg editor
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2019-8152?
The severity of CVE-2019-8152 is considered high due to its potential for stored cross-site scripting attacks.
How do I fix CVE-2019-8152?
To fix CVE-2019-8152, update your Magento installation to versions 1.9.4.3, 1.14.4.3 for Magento 1, or 2.2.10 and 2.3.3 for Magento 2.
What versions are affected by CVE-2019-8152?
CVE-2019-8152 affects Magento 1 prior to 1.9.4.3, Magento 2.2 prior to 2.2.10, and Magento 2.3 prior to 2.3.3.
Who can exploit CVE-2019-8152?
An authenticated user with access to the WYSIWYG editor can exploit CVE-2019-8152 to inject malicious scripts.
What type of vulnerability is CVE-2019-8152?
CVE-2019-8152 is classified as a stored cross-site scripting (XSS) vulnerability.