CVE-2019-7940
A stored cross-site scripting vulnerability exists in the admin panel of Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with privileges to modify store currency options to inject malicious javascript.
| Software | From | Fixed in |
|---|---|---|
| magento / magento | 2.1.0 | 2.1.18 |
| magento / magento | 2.2.0 | 2.2.9 |
| magento / magento | 2.3.0 | 2.3.2 |
| magento / magento | - | 1.14.4.2 |
| magento / magento | - | 1.9.4.2 |
Deep Security Visibility Without the Complexity
SynScan provides clear, real-time security insights so you can monitor your attack surface, spot risks early, and act fast—without extra complexity.
- No setup fees
- 5-min deployment
- Cancel anytime