CVE-2019-8227: Magento XSS Vulnerability
In Magento prior to 1.9.4.3 and Magento prior to 1.14.4.3, an authenticated user with limited administrative privileges can inject arbitrary JavaScript code via import / export functionality when creating profile action XML.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/magento/coreto a version that resolves this vulnerability.Fixed in 1.9.4.3
Event History
Frequently Asked Questions
What is the severity of CVE-2019-8227?
CVE-2019-8227 has a medium severity rating due to the potential for injection of arbitrary JavaScript code.
How do I fix CVE-2019-8227?
To mitigate CVE-2019-8227, upgrade Magento to the latest versions 1.9.4.3 or 1.14.4.3 or later.
Who is affected by CVE-2019-8227?
CVE-2019-8227 affects Magento users operating versions prior to 1.9.4.3 for open source and 1.14.4.3 for commerce.
What types of users can exploit CVE-2019-8227?
An authenticated user with limited administrative privileges can exploit CVE-2019-8227.
What does CVE-2019-8227 allow an attacker to do?
CVE-2019-8227 allows an attacker to inject arbitrary JavaScript code through the import/export functionality in Magento.