GHSA-j49x-jjmj-9fqjMediumCVSS 4.8

Magento XSS Vulnerability

Published
May 24, 2022
Last Modified
January 11, 2024

🔗 CVE IDs covered (1)

CVE-2019-8227 →

📋 Description

In Magento prior to 1.9.4.3 and Magento prior to 1.14.4.3, an authenticated user with limited administrative privileges can inject arbitrary JavaScript code via import / export functionality when creating profile action XML.

🎯 Affected products1

  • composer/magento/core:< 1.9.4.3

🔗 References (3)