CVE-2019-7877

Vulnerability

A stored cross-site scripting (XSS) vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, and Magento 2.3 prior to 2.3.2 [1][2]. An authenticated user with privileges to manage orders can inject malicious JavaScript into order-related fields, which is then stored and executed when other admin users view the affected order [2].

Exploitation

An attacker must be authenticated and have the necessary privileges to manage orders in the Magento admin panel [2]. The attacker can inject malicious JavaScript into input fields such as order comments or customer details. When another admin user accesses the order page, the injected script executes in the context of that user's session [1][2].

Impact

Successful exploitation allows the attacker to execute arbitrary JavaScript in the admin panel of other users. This can lead to session hijacking, theft of sensitive data, or further compromise of the Magento instance [1][2]. The attack is stored, meaning the malicious payload persists and affects all subsequent viewers of the affected order.

Mitigation

The vulnerability is fixed in Magento 2.1.18, 2.2.9, and 2.3.2, released on August 2, 2019 [1]. Users should upgrade to these versions or later. No workaround is documented in the available references [1][2].