Magento 2 Community Edition XSS Vulnerability
Moderate severity
GitHub Reviewed
Published
May 24, 2022
to the GitHub Advisory Database
•
Updated Feb 12, 2024
Package
Affected versions
>= 2.3.0, < 2.3.2-p2
Patched versions
2.3.2-p2
Description
Published by the National Vulnerability Database
Nov 6, 2019
Published to the GitHub Advisory Database
May 24, 2022
Reviewed
Aug 1, 2023
Last updated
Feb 12, 2024
A stored cross-site scripting (XSS) vulnerability exists in Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated admin user can inject arbitrary JavaScript code when creating a content page via page builder.
As per the Magento Release 2.3.3, if you have already implemented the pre-release version of this patch (2.3.2-p1), it is highly recommended to promptly upgrade to 2.3.2-p2.
References