« Volver al listado

CVE-2019-8157

Estado: ModificadaMedia (5.4)—

A stored cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can manipulate downloadable link and cause an invocation of error handling that acceses user input without sanitization.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Magento — Magento

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2019-8157",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 3.5,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:S/C:N/I:P/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "LOW",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 6.8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "CHANGED",
          "version": "3.1",
          "baseScore": 5.4,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N",
          "integrityImpact": "LOW",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "LOW"
        },
        "impactScore": 2.7,
        "exploitabilityScore": 2.3
      }
    ]
  },
  "affected": [
    {
      "source": "psirt@adobe.com",
      "affectedData": [
        {
          "vendor": "Adobe Systems Incorporated",
          "product": "Magento 2",
          "versions": [
            {
              "status": "affected",
              "version": "Magento 2.2 prior to 2.2.10"
            },
            {
              "status": "affected",
              "version": "Magento 2.3 prior to 2.3.3 or 2.3.2-p1"
            }
          ]
        }
      ]
    }
  ],
  "published": "2019-11-06T01:15:25.387",
  "references": [
    {
      "url": "https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "psirt@adobe.com"
    },
    {
      "url": "https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-79"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A stored cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can manipulate downloadable link and cause an invocation of error handling that acceses user input without sanitization."
    },
    {
      "lang": "es",
      "value": "Existe una vulnerabilidad de tipo cross-site scripting (XSS) almacenado en Magento versiones 2.2 anteriores a 2.2.10, Magento versiones 2.3 anteriores a 2.3.3 o 2.3.2-p1. Un usuario autenticado puede manipular un enlace descargable y causar una invocación de manejo de errores que acceda a la entrada del usuario sin saneamiento."
    }
  ],
  "lastModified": "2026-06-17T02:41:35.247",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:magento:magento:*:*:*:*:commerce:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "24318637-C95B-4811-87F5-14A6F4EDE2EC",
              "versionEndExcluding": "2.2.10",
              "versionStartIncluding": "2.2.0"
            },
            {
              "criteria": "cpe:2.3:a:magento:magento:*:*:*:*:open_source:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "A06CF88F-F067-4058-9306-864FEA3D7062",
              "versionEndExcluding": "2.2.10",
              "versionStartIncluding": "2.2.0"
            },
            {
              "criteria": "cpe:2.3:a:magento:magento:*:*:*:*:commerce:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "B720D2FA-A6FD-49A3-8B78-07993560081D",
              "versionEndExcluding": "2.3.2",
              "versionStartIncluding": "2.3.0"
            },
            {
              "criteria": "cpe:2.3:a:magento:magento:*:*:*:*:open_source:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "6B8C5A27-2957-4373-B0FE-8C7585B4B04E",
              "versionEndExcluding": "2.3.2",
              "versionStartIncluding": "2.3.0"
            },
            {
              "criteria": "cpe:2.3:a:magento:magento:2.3.2:-:*:*:commerce:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "ED7EB5B4-33F4-4389-BCA4-50A113F8C719"
            },
            {
              "criteria": "cpe:2.3:a:magento:magento:2.3.2:-:*:*:open_source:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "465133F9-0BFE-491E-8FE8-A263F9E2FC1D"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "psirt@adobe.com"
}