Magento Reflected cross-site scripting on customer cart page
The advisory, in context
A reflected cross-site scripting vulnerability exists on the customer cart checkout page of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by sending a victim a crafted URL that results in malicious javascript execution in the victim's browser.
Affected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
From 2.1 before 2.1.18
Fixed in 2.1.18
21 explicitly affected versions
2.1.0, 2.1.0-rc1, 2.1.0-rc2, 2.1.0-rc3, 2.1.1, 2.1.10, 2.1.11, 2.1.12, 2.1.13, 2.1.14, 2.1.15, 2.1.16, 2.1.17, 2.1.2, 2.1.3, 2.1.4, 2.1.5, 2.1.6, 2.1.7, 2.1.8, 2.1.9
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "2.1"
},
{
"fixed": "2.1.18"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"2.1.0",
"2.1.0-rc1",
"2.1.0-rc2",
"2.1.0-rc3",
"2.1.1",
"2.1.10",
"2.1.11",
"2.1.12",
"2.1.13",
"2.1.14",
"2.1.15",
"2.1.16",
"2.1.17",
"2.1.2",
"2.1.3",
"2.1.4",
"2.1.5",
"2.1.6",
"2.1.7",
"2.1.8",
"2.1.9"
]
}From 2.2 before 2.2.9
Fixed in 2.2.9
9 explicitly affected versions
2.2.0, 2.2.1, 2.2.2, 2.2.3, 2.2.4, 2.2.5, 2.2.6, 2.2.7, 2.2.8
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "2.2"
},
{
"fixed": "2.2.9"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"2.2.0",
"2.2.1",
"2.2.2",
"2.2.3",
"2.2.4",
"2.2.5",
"2.2.6",
"2.2.7",
"2.2.8"
]
}From 2.3 before 2.3.2
Fixed in 2.3.2
2 explicitly affected versions
2.3.0, 2.3.1
View affected-version evidence
{
"ranges": [
{
"events": [
{
"introduced": "2.3"
},
{
"fixed": "2.3.2"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"2.3.0",
"2.3.1"
]
}