CVE-2019-8152: Magento 2 Community Edition XSS Vulnerability
A stored cross-site scripting (XSS) vulnerability exists in in Magento 1 prior to 1.9.4.3 and 1.14.4.3, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with access to the wysiwyg editor can abuse the blockDirective() function and inject malicious javascript in the cache of the admin dashboard.
As per the Magento Release 2.3.3, if you have already implemented the pre-release version of this patch (2.3.2-p1), it is highly recommended to promptly upgrade to 2.3.2-p2.
Other sources
A stored cross-site scripting (XSS) vulnerability exists in in Magento 1 prior to 1.9.4.3 and 1.14.4.3, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with access to the wysiwyg editor can abuse the blockDirective() function and inject malicious javascript in the cache of the admin dashboard.
Magento 2 Community Edition XSS Vulnerability
— Packagist
PRODSECBUG-2344: Cross-Site Scripting via wysiwyg editor
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/magento/community-editionto a version that resolves this vulnerability.Fixed in 2.3.2-p2 - Upgrade
Upgrade
composer/magento/community-editionto a version that resolves this vulnerability.Fixed in 2.2.10 - Upgrade
Upgrade
composer/magento/product-community-editionto a version that resolves this vulnerability.Fixed in 2.2.10 - Upgrade
Upgrade
composer/magento/product-community-editionto a version that resolves this vulnerability.Fixed in 2.3.2-p2 - Upgrade
Upgrade
composer/magento/magento1eeto a version that resolves this vulnerability.Fixed in 1.14.4.3 - Upgrade
Upgrade
composer/magento/magento1ceto a version that resolves this vulnerability.Fixed in 1.9.4.3 - Upgrade
Upgrade
Magento 1.9to a version that resolves this vulnerability.Fixed in 1.9.4.3 - Upgrade
Upgrade
Magento 1.14to a version that resolves this vulnerability.Fixed in 1.14.4.3 - Upgrade
Upgrade
Magento 2.2to a version that resolves this vulnerability.Fixed in 2.2.10 - Upgrade
Upgrade
Magento 2.3to a version that resolves this vulnerability.Fixed in 2.3.3 - Upgrade
Upgrade
Magento 2.3.2-p1to a version that resolves this vulnerability.Fixed in 2.3.2-p2
Event History
Frequently Asked Questions
What is the severity of CVE-2019-8152?
The severity of CVE-2019-8152 is considered high due to its potential for stored cross-site scripting attacks.
How do I fix CVE-2019-8152?
To fix CVE-2019-8152, update your Magento installation to versions 1.9.4.3, 1.14.4.3 for Magento 1, or 2.2.10 and 2.3.3 for Magento 2.
What versions are affected by CVE-2019-8152?
CVE-2019-8152 affects Magento 1 prior to 1.9.4.3, Magento 2.2 prior to 2.2.10, and Magento 2.3 prior to 2.3.3.
Who can exploit CVE-2019-8152?
An authenticated user with access to the WYSIWYG editor can exploit CVE-2019-8152 to inject malicious scripts.
What type of vulnerability is CVE-2019-8152?
CVE-2019-8152 is classified as a stored cross-site scripting (XSS) vulnerability.