Kurz gesagt
- CVE-2019-8138 ist eine Schwachstelle (MITTEL (CVSS 5.4)) in magento/community-edition, magento (magento).
- Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.56%, höher als bei 46.4% aller Schwachstellen.
- Abhilfe: auf 2.2.10, 2.3.2-p1, 2.3.2 oder neuer aktualisieren.
| Package | Affected versions | Patched versions |
|---|
| magento/community-edition Packagist | ≥ 2.2.0, < 2.2.10≥ 2.3.0, < 2.3.2-p1
| 2.2.102.3.2-p1
|
| magento | = 2.3.2≥ 2.2.0, < 2.2.10≥ 2.3.0, < 2.3.2
| 2.2.102.3.2
|
Description
A stored cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can execute arbitrary JavaScript code by providing arbitrary API endpoint that will not be chcecked by sale pickup event.
NVD description
A stored cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can execute arbitrary JavaScript code by providing arbitrary API endpoint that will not be chcecked by sale pickup event.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free