Test ID:	1.3.6.1.4.1.25623.1.0.142211
Category:	Web application abuses
Title:	Magento 2.x Multiple Vulnerabilities - March19
Summary:	Magento 2.x is prone to multiple vulnerabilities.
Description:	Summary: Magento 2.x is prone to multiple vulnerabilities. Vulnerability Insight: Magento 2.x is prone to multiple vulnerabilities: - Remote code execution though crafted newsletter and email templates - Remote code execution through email template - SQL Injection and cross-site scripting vulnerability in Catalog section (XSS) - SQL Injection vulnerability through an unauthenticated user - Arbitrary code execution due to unsafe deserialization of a PHP archive - Arbitrary code execution due to the unsafe handling of an API call to a core bundled extension - Arbitrary code execution due to unsafe deserialization of a PHP Archive - Sensitive data disclosure due to NGINX configuration's regular expressions not being restricted to the explicit directories - Cross Site Scripting in newsletter template name - Stored cross-site scripting in the Admin Customer Segments area - Unauthorized implementation due to bypassing the need for administrator authentication approval on B2B accounts - Unauthorized data control due to a bypass of authentication controls for a customer using a web API endpoint - SQL injection due to inadequate validation of user input - Reflected cross-site scripting vulnerability in the Admin through the requisition list ID - Stored cross-site scripting in the admin panel via the Admin Shopping Cart Rules page - Deletion of a product attribute through cross-site request forgery - Site map deletion through cross-site request forgery - Deletion of synonym groups through a cross-site request forgery vulnerability - Stored cross-site scripting in the admin panel via the Terms & Conditions with Checkbox Text field in the admin panel. - Stored cross-site scripting in the Admin through the Admin Notification function - Stored cross-site scripting vulnerability in Admin product names - Stored cross-site scripting in the Admin through B2B packages - Stored cross-site scripting vulnerability - Stored cross-site scripting vulnerability in the Admin through the Checkbox Custom Option Value field - Stored cross-site scripting vulnerability in the Admin through B2B packages - Stored cross-site scripting in the admin panel via the Attribute Label for Media Attributes section - Reflected cross-site scripting through manipulation of the Admin notification feed URL - Stored cross-site scripting in the Admin Catalog configuration section - Stored cross-site scripting in the Admin panel through the product configurations section - WYSIWYG - Missing CAPTCHA on Send to a friend page - Information disclosure in Magento 2.x default configuration - Sensitive Data Disclosure due toInsecure Direct Object References vulnerability - Spam using share a wishlist functionality - Admin credentials are logged in exception reports - Unauthorized access to wishlist via Insecure direct object reference in the application - HTML injection vulnerability due to insufficient data validation Solution: Update to version 2.1.17, 2.2.8, 2.3.1 or later. CVSS Score: 4.0 CVSS Vector: AV:N/AC:L/Au:S/C:P/I:N/A:N
Cross-Ref:	Common Vulnerability Exposure (CVE) ID: CVE-2019-8235
Copyright	Copyright (C) 2019 Greenbone Networks GmbH

This is only one of 99761 vulnerability tests in our test suite. Find out more about running a complete security audit. To run a free test of this vulnerability against your system, register below.