CVE-2019-7939

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2019-7939

Import Source

https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2019-7939.json

JSON Data

https://api.test.osv.dev/v1/vulns/CVE-2019-7939

Aliases

GHSA-r728-jwf5-f5r5

Published

2019-08-02T22:15:19.003Z

Modified

2025-12-06T14:02:34.531264Z

Severity

6.1 (Medium) CVSS_V3 - CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N CVSS Calculator

Summary

[none]

Details

A reflected cross-site scripting vulnerability exists on the customer cart checkout page of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by sending a victim a crafted URL that results in malicious javascript execution in the victim's browser.

References

https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23

Affected packages

Git / github.com/magento/devdocs

Affected ranges

Type: GIT
Repo: https://github.com/magento/devdocs
Events: Introduced

60523b1194f96e18c94c82b5515b0274b30e2151

Fixed

452b21aa6d3a221b587ca32d2d50785d92dd6aa1

Affected versions

2.*

2.0.10

2.0.11

2.0.12

2.0.13

2.0.14

2.0.15

2.0.16

2.0.17

2.0.18

2.0.8

2.0.9

2.1.0

2.1.1

2.1.10

2.1.11

2.1.12

2.1.13

2.1.14

2.1.15

2.1.16

2.1.17

2.1.2

2.1.3

2.1.4

2.1.5

2.1.6

2.1.7

2.1.8

2.1.9

2.2.0

2.2.1

2.2.2

2.2.3

2.2.4

2.2.5

2.2.6

2.2.7

2.2.8

2.3.0

2.3.1

Database specific

source

"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2019-7939.json"

Git / github.com/magento/magento2