TI-2019-05821 Aliases CVE-2019-8148 GHSA-86pc-6mm8-542r

Cross-site scripting in Adobe Magento 2

LOW 23CWE-79Published 2019-11-05 · Updated 2024-08-04

Key facts

Attack vector: Network
Privileges required: High
User interaction: Required
Attack complexity: Low
Impact type: Cross-site scripting
Confidentiality · integrity · availability: Low · Low · None
Fix status: Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-79.

Summary

A stored cross-site scripting (XSS) vulnerability exists in Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated admin user can inject arbitrary JavaScript code when creating a content page via page builder.

Why it matters now

EPSS 0.00552 46th percentileScored 2026-11-07

Fix Fixed magento/community-edition (Packagist): 2.3.2-p2

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Adobe	Magento 2	Magento 2.3 prior to 2.3.3 or 2.3.2-p1	—	No fix listed	CNA
—	magento/community-edition (Packagist)	2.3.0 to before 2.3.2-p2	2.3.2-p2	Patch available	GHSA-86pc-6mm8-542r

Magento 2 VendorAdobe Affected Magento 2.3 prior to 2.3.3 or 2.3.2-p1 Fixed in — No fix listed CNA
magento/community-edition (Packagist) Vendor— Affected 2.3.0 to before 2.3.2-p2 Fixed in 2.3.2-p2 Patch available GHSA-86pc-6mm8-542r

CPE configurations NVD · 4

CPE	Versions	Role	Vendor
cpe:2.3:a:magento:magento:::::commerce:::*	2.3.0 to before 2.3.2	Vulnerable	Magento
cpe:2.3:a:magento:magento:::::open_source:::*	2.3.0 to before 2.3.2	Vulnerable	Magento
cpe:2.3:a:magento:magento:2.3.2:-:::commerce:::*	2.3.2	Vulnerable	Magento
cpe:2.3:a:magento:magento:2.3.2:-:::open_source:::*	2.3.2	Vulnerable	Magento

cpe:2.3:a:magento:magento:*:*:*:*:commerce:*:*:* Versions 2.3.0 to before 2.3.2 Vulnerable ·Magento
cpe:2.3:a:magento:magento:*:*:*:*:open_source:*:*:* Versions 2.3.0 to before 2.3.2 Vulnerable ·Magento
cpe:2.3:a:magento:magento:2.3.2:-:*:*:commerce:*:*:* Versions 2.3.2 Vulnerable ·Magento
cpe:2.3:a:magento:magento:2.3.2:-:*:*:open_source:*:*:* Versions 2.3.2 Vulnerable ·Magento

Remediation

Fix · GHSA-86pc-6mm8-542r magento/community-edition (Packagist) Fixed in 2.3.2-p2 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2019-8148
2026-10-03 Alias added: GHSA-86pc-6mm8-542r

References

Patch 1

https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2019-8148

Other 2

TI-2026-52938 Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336) KEVCVSS 3.1CRITICAL 10.0
TI-2026-35688 ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) KEVCVSS 3.1CRITICAL 10.0
TI-2025-34084 Adobe Experience Manager | Incorrect Authorization (CWE-863) KEVCVSS 3.1CRITICAL 10.0
TI-2024-22559 XXE can expose crypt key and other secrets granting full admin access KEVCVSS 3.1CRITICAL 9.8
TI-2023-19615 Analysis CVE-2023-29300 Bypass: Adobe ColdFusion Pre-Auth RCE KEVCVSS 3.1CRITICAL 9.8
TI-2023-13696 Adobe ColdFusion Deserialization of Untrusted Data Arbitrary code execution KEVCVSS 3.1CRITICAL 9.8

See all 8046 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences