{"id":"CVE-2019-8148","details":"A stored cross-site scripting (XSS) vulnerability exists in Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated admin user can inject arbitrary JavaScript code when creating a content page via page builder.","aliases":["GHSA-86pc-6mm8-542r"],"modified":"2025-12-02T23:52:01.712811Z","published":"2019-11-06T00:15:12.280Z","references":[{"type":"FIX","url":"https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/magento/devdocs","events":[{"introduced":"75da24b3b0fb950648d00e7454dae0bb7da64c30"},{"fixed":"452b21aa6d3a221b587ca32d2d50785d92dd6aa1"}]}],"versions":["2.1.16","2.1.17","2.2.7","2.2.8","2.3.0","2.3.1"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2019-8148.json"}},{"ranges":[{"type":"GIT","repo":"https://github.com/magento/magento2","events":[{"introduced":"f4c1d7526f05bdfb1327b0701cc345f94aadcaed"},{"fixed":"ddf42caaf25311f10b23b95a92746f99943e045e"}]}],"versions":["2.3.0","2.3.1"],"database_specific":{"source":"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2019-8148.json"}}],"schema_version":"1.7.3","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"}]}