CVE-2019-8233: XSS
Published Nov 5, 2019
·Updated
In Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1, an unauthenticated user can inject arbitrary JavaScript code as a result of the sanitization engine ignoring HTML comments.
Affected Software
8 affected componentsFixes available
composer/magento/community-edition>=2.3<2.3.3
2.3.3
composer/magento/community-edition>=2.2<2.2.10
2.2.10
Magento Magento>=2.2.0<2.2.10
Magento Magento>=2.2.0<2.2.10
Magento Magento>=2.3.0<2.3.2
Magento Magento>=2.3.0<2.3.2
Magento Magento=2.3.2
Magento Magento=2.3.2
Event History
Nov 5, 2019
CVE Published
via MITRE·11:54 PM
Data Sourced
via MITRE·11:54 PM
DescriptionWeakness
Nov 12, 2019
Advisory Published
10:59 PM
Frequently Asked Questions
1
What is the severity of CVE-2019-8233?
CVE-2019-8233 has a medium severity rating due to its impact allowing unauthenticated JavaScript code injection.
2
How do I fix CVE-2019-8233?
To fix CVE-2019-8233, upgrade to Magento version 2.3.3 or 2.2.10 or later.
3
What versions are affected by CVE-2019-8233?
CVE-2019-8233 affects Magento versions 2.2 prior to 2.2.10 and 2.3 prior to 2.3.3 or 2.3.2-p1.
4
What is the impact of CVE-2019-8233 on my Magento store?
CVE-2019-8233 allows an unauthenticated user to execute arbitrary JavaScript, potentially compromising user data and security.
5
Is CVE-2019-8233 related to HTML comments?
Yes, CVE-2019-8233 occurs because the sanitization engine improperly handles HTML comments, enabling code injection.