Description
A reflected cross-site scripting vulnerability exists in the Product widget chooser functionality in the admin panel for Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Magento 2 | Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | magento/community-edition | >= 2.1.0, < 2.1.18 | 2.1.18 | GHSA-m3v2-r236-5xgq |
| Packagist | magento/community-edition | >= 2.2.0, < 2.2.9 | 2.2.9 | GHSA-m3v2-r236-5xgq |
| Packagist | magento/community-edition | >= 2.3.0, < 2.3.2 | 2.3.2 | GHSA-m3v2-r236-5xgq |