CVE-2019-8233: Composer JavaScript injection possible via html comments
Composer JavaScript injection possible via html comments
Other sources
In Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1, an unauthenticated user can inject arbitrary JavaScript code as a result of the sanitization engine ignoring HTML comments.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/magento/community-editionto a version that resolves this vulnerability.Fixed in 2.3.3 - Upgrade
Upgrade
composer/magento/community-editionto a version that resolves this vulnerability.Fixed in 2.2.10
Event History
Frequently Asked Questions
What is the severity of CVE-2019-8233?
CVE-2019-8233 has a medium severity rating due to its impact allowing unauthenticated JavaScript code injection.
How do I fix CVE-2019-8233?
To fix CVE-2019-8233, upgrade to Magento version 2.3.3 or 2.2.10 or later.
What versions are affected by CVE-2019-8233?
CVE-2019-8233 affects Magento versions 2.2 prior to 2.2.10 and 2.3 prior to 2.3.3 or 2.3.2-p1.
What is the impact of CVE-2019-8233 on my Magento store?
CVE-2019-8233 allows an unauthenticated user to execute arbitrary JavaScript, potentially compromising user data and security.
Is CVE-2019-8233 related to HTML comments?
Yes, CVE-2019-8233 occurs because the sanitization engine improperly handles HTML comments, enabling code injection.