CVE-2019-7880

Vulnerability

Overview

CVE-2019-7880 is a stored cross-site scripting (XSS) vulnerability in the Magento admin panel, affecting Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, and Magento 2.3 prior to 2.3.2 [1][2]. The root cause is insufficient sanitization of input within marketing email templates, allowing malicious JavaScript to be stored and later executed in the context of other admin users.

Exploitation

Exploitation requires an authenticated user with privileges to create or modify marketing email templates [1][2]. The attacker injects malicious script content into a template field, which is then stored on the server. When an administrator views the affected template (e.g., in preview or editing interfaces), the injected script executes in their browser session, bypassing the same-origin policy.

Impact

Successful exploitation leads to arbitrary JavaScript execution within the admin panel, potentially enabling an attacker to perform actions on behalf of the victim, access sensitive data, alter configurations, or escalate privileges within the Magento instance.

Mitigation

Adobe has released security patches fixing this vulnerability in Magento 2.3.2, 2.2.9, and 2.1.18 [1]. Users should upgrade to these or later versions. No workarounds are documented; the KEV catalog does not list this CVE.