Magento 2.3.2, 2.2.9 and 2.1.18 Security Update 1/3

A stored cross-site scripting vulnerability exists in the admin panel. This could be exploited by an authenticated user with privileges to the admin panel to inject malicious javascript. In some configurations, the issue could be exploited by an unauthenticated user using the store front. NOTE: Patch for this issue is available also for earlier versions of Magento - more details here.

An authenticated user with admin privileges can execute arbitrary code through a crafted XML layout update.

An authenticated user with admin privileges can execute arbitrary code through combination of product import via crafted csv file and XML layout update.

An authenticated user with admin privileges to the import feature can execute arbitrary code by uploading a malicious csv file.

An authenticated user can inject form data and bypass security protections that prevent arbitrary PHP script upload.

An authenticated user with admin privileges can execute arbitrary code when creating a product via malicious XML layouts.

An authenticated user with admin privileges can execute arbitrary code through crafted email template code when previewing the template.

An authenticated user with admin privileges to create sitemaps can execute arbitrary code by crafted filenames that include php extension within the XML filename.

An authenticated user with privileges to configure the catalog search can execute arbitrary code through malicious configuration of the Elastic search module.

Unauthenticated users can pass arbitrary values for company attributes parmeters via POST and PUT action and assign themselves to arbitray company effectively gaining access to company's confidental information.

Insufficient enforcement of user access controls can be abused by a low-privileged user to make unauthorized environment configuration changes, such as removing security controls.

An unauthenticated user in Magento 2.x, or an authenticated user in Magento 1.x, can execute SQL statements that allow arbitrary read access to the underlying database.

Note: this issue was addressed in previous patches 2.2.8 and 2.3.1 and also in separately released patches PRODSECBUG-2198. In this release, it adds a fix for version 2.1.x.

Insufficient brute-forcing defenses in the token exchange protocol between Magento and payment processors could be abused in carding attacks.

An authenticated user with admin privileges to access shipment settings can execute arbitrary code through server-side request forgery.

An authenticated user with privileges to manipulate layout can execute arbitrary code through crafted custom layout update field.

An authenticated user with admin privileges to manipulate shipment settings can execute arbitrary code through server-side request forgery

An authenticated user with admin privileges to manipulate shipment methods can execute arbitrary code through server-side request forgery.

An authenticated user with admin privileges to manipulate system configuration can execute arbitrary code through server-side request forgery.

A SOAP web service endpoint does not properly enforce parameters related to access control list and customer identifications allowing arbitrary customer identification in crafted SOAP requests.

An attacker can upload malicious files due to insufficient server side validations.

An attacker can cause a denial-of-service via a crafted request that results in the Magento store serving a cached 404 error response.

Insufficient authorization checks could be abused by a user with admin privileges to add users to company accounts, or modify existing user details.

An attacker can delete user roles within the context of an authenticated administrator's session through cross-site request forgery (CSRF)

A stored cross-site scripting vulnerability exists in the admin panel. This could be exploited by an authenticated user with privileges to the admin panel to inject malicious javascript.

A stored cross-site scripting vulnerability exists in the admin panel. This could be exploited by an authenticated user with privileges to the admin panel to inject malicious javascript.

A stored cross-site scripting vulnerability exists in the catalog marketing events form. This could be exploited by an authenticated user with privileges to catalog events to inject malicious javascript.

A reflected cross-site scripting vulnerability exists in the admin panel. This could be exploited by an authenticated user with privileges to the admin panel to inject malicious javascript.

A stored cross-site scripting vulnerability exists in the admin panel. This could be exploited by an authenticated user with privileges to the admin panel to inject malicious javascript.

An authenticated user with marketing manipulation privileges can invoke methods that alter data of the underlying model followed by corresponding database modifications.

A stored cross-site scripting vulnerability exists in the admin panel. This could be exploited by an authenticated user with privileges to the admin panel to inject malicious javascript.