Medium
Security advisory
A stored cross-site scripting vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with privileges to the tax notifications configuration in the Magento admin panel.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2019-7853
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 08:14 UTC · Revision 1
Source evidence
A stored cross-site scripting vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with privileges to the tax notifications configuration in the Magento admin panel.
osv:CVE-2019-7853
Complete source record
{
"id": "95393b53e431ad5772968c0a83ff91ee9231fc9e113a322bcb9d2864ef7c350e",
"url": "https://osv.dev/vulnerability/CVE-2019-7853",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2019-7853",
"summary": "A stored cross-site scripting vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with privileges to the tax notifications configuration in the Magento admin panel.",
"evidence": "osv:CVE-2019-7853",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2019-7853",
"aliases": [
"CVE-2019-7853",
"GHSA-mjgf-xmrr-6gvx"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/magento/devdocs",
"type": "GIT",
"events": [
{
"introduced": "60523b1194f96e18c94c82b5515b0274b30e2151"
},
{
"fixed": "452b21aa6d3a221b587ca32d2d50785d92dd6aa1"
},
{
"introduced": "239bfc72e116f6814ff6c2f6731f0830f3bcf61c"
},
{
"fixed": "452b21aa6d3a221b587ca32d2d50785d92dd6aa1"
},
{
"introduced": "75da24b3b0fb950648d00e7454dae0bb7da64c30"
},
{
"fixed": "452b21aa6d3a221b587ca32d2d50785d92dd6aa1"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:magento:magento:*:*:*:*:open_source:*:*:*",
"range": [
{
"introduced": "2.1.0"
},
{
"fixed": "2.1.18"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:magento:magento:*:*:*:*:open_source:*:*:*",
"range": [
{
"introduced": "2.2.0"
},
{
"fixed": "2.2.9"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:magento:magento:*:*:*:*:open_source:*:*:*",
"range": [
{
"introduced": "2.3.0"
},
{
"fixed": "2.3.2"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"2.3.0",
"2.2.7",
"2.1.16",
"2.3.1",
"2.2.8",
"2.1.17"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-7853.json"
}
},
{
"ranges": [
{
"repo": "https://github.com/magento/magento2",
"type": "GIT",
"events": [
{
"introduced": "909a2d7e8c2ac5ca55359827c22cea93fdb719df"
},
{
"fixed": "b808e00f4ad6fb33d5622171a88eb68877ae318d"
},
{
"introduced": "07465f8ce879ff0bd0ba72a662c9e2473e49afe4"
},
{
"fixed": "0a1a283cd6a0cf4b98a051867f90150c9490fcec"
},
{
"introduced": "f4c1d7526f05bdfb1327b0701cc345f94aadcaed"
},
{
"fixed": "ddf42caaf25311f10b23b95a92746f99943e045e"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:magento:magento:*:*:*:*:open_source:*:*:*",
"range": [
{
"introduced": "2.1.0"
},
{
"fixed": "2.1.18"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:magento:magento:*:*:*:*:open_source:*:*:*",
"range": [
{
"introduced": "2.2.0"
},
{
"fixed": "2.2.9"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:magento:magento:*:*:*:*:open_source:*:*:*",
"range": [
{
"introduced": "2.3.0"
},
{
"fixed": "2.3.2"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"2.3.1",
"2.3.0",
"2.2.0-rc2.2",
"2.2.0-rc2.3",
"2.2.0-rc2.1",
"2.2.0-rc2.0",
"2.2.0-RC1.8",
"2.2.0-RC1.6",
"2.2.0-RC1.3",
"2.2.0-RC1.5",
"2.2.0-RC1.4",
"2.2.0-RC1.2",
"2.1.5",
"2.2.0-RC1.1",
"2.1.6",
"2.1.4",
"2.1.2",
"2.1.1",
"2.1.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-7853.json"
}
}
],
"modified": "2026-10-24T10:31:04.663950332Z",
"provider": "osv",
"references": [
"https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23",
"https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-24"
],
"provider_metadata": {}
},
"related_cves": [
{
"value": "CVE-2019-7853",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 440581,
"published_at": "2019-08-02T22:15:14.847+00:00"
}