CVE-2019-7867

Vulnerability

Description CVE-2019-7867 is a stored cross-site scripting (XSS) vulnerability in the admin panel of Magento 2.1 (prior to 2.1.18), 2.2 (prior to 2.2.9), and 2.3 (prior to 2.3.2). The vulnerability allows an authenticated user with privileges to manage orders and order status to inject arbitrary JavaScript into the admin interface [1][2].

Exploitation

The attack vector requires the attacker to have a valid authenticated session with permissions to modify order status. The injected script is stored on the server and executed when an administrator views the affected order management page, leading to XSS [1].

Impact

Successful exploitation could enable an attacker to execute malicious scripts in the context of the admin user's session, potentially allowing theft of sensitive data, unauthorized actions, or further compromise of the Magento installation [2].

Mitigation

Adobe released security updates that address this vulnerability: Magento 2.1.18, 2.2.9, and 2.3.2. Users are advised to upgrade immediately [1][2].