Magento 2.3.1, 2.2.8 and 2.1.17 Security Update

An authenticated user with privileges to create newsletter or email templates can execute arbitrary code through crafted newsletter or email template code.

An authenticated user with administrative privileges can execute arbitrary code through email templates

An authenticated user can embed malicious code through a stored cross-site scripting vulnerability or an SQL injection vulnerability in the Catalog section by manipulating attribute_code.

An unauthenticated user can execute arbitrary code through an SQL injection vulnerability, which causes sensitive data leakage. NOTE: This patch is not included in 2.1.17. Please apply PRODSECBUG-2198 patch in addition to upgrade to 2.1.17.

An authenticated user with administrative privileges can execute arbitrary code through a Phar deserialization vulnerability.

An authenticated user with privileges to configure store settings can execute arbitrary code execution through server-side request forgery.

An authenticated user with privileges to configure email templates can execute arbitrary code via a PHP archive deserialization vulnerability.

An authenticated userwith administrative privileges can upload PHP files to access sensitive data because NGINX configuration allows PHP files to be executed in any directory.

An authenticated user with administrative privileges can embed arbitrary code when editing the Newsletter section of the admin panel.

An authenticated user with privileges to the Customer Segments section of the Admin can use a stored cross site scripting vulnerability to embed malicious code.

An authenticated user can create a B2B account without administrative approval due to an authentication bypass vulnerability.

An authenticated customer can control other customer's requistion lists by using a web API endpoint to send a request to the server. (This overrides the customer_id parameter.)

An authenticated user with privileges to configure email templatescan execute arbitrary SQL queries.

An authenticated user with privileges to the Admin requisition list ID can use a cross-site scripting vulnerability to embed malicious code.

An authenticated user with administrative privileges can embed arbitrary code in the Conditions tab of Admin Shopping Cart Rules page.

An attacker can delete a product attribute within the context of authenticated administrator's session through cross-site request forgery.

An attacker can delete the site map within the context of an authenticated administrator's session through cross-site request forgery.

An attacker can delete all synonyms groups within the context of an authenticated administrator's session through cross-site request forgery.

An authenticated user with administrative privileges can embed arbitrary code via a stored cross site scripting vulnerability in the Terms & Conditions with Checkbox Text field in the admin panel.

An authenticated user with privileges to edit the Admin notification section can use a stored cross-site scripting vulnerability to embed malicious code.

An authenticated user with privileges to product name fields on the Admin can use stored cros-site scripting vulnerability to embed malicious code.

An authenticated user with privileges to the B2B packages through an unsanitized URL parameter can use a stored cross-site scripting vulnerability to embed malicious code.

An authenticated user with privileges to the Admin **Stores** > **Attributes** > **Product ** configuration area can use a stored cross-site scripting vulnerability to embed malicious code.

An authenticated user with privileges to the Checkbox Custom Option Value field on the Admin can use a stored cross-site scripting vulnerability to embed malicious code.

An authenticated user with privileges to B2B packages through an unsanitized URL parameter can use a stored cross-site scripting vulnerability to embed malicious code.

An authenticated user with administrative privileges can embed malicious code in the Attribute Label for Media Attributes section in the admin panel

An authenticated user with administrative privileges can manipulate the notification feed , which allows an attacker to use a cross-site scripting vulnerability to embed malicious code.

An authenticated user with privileges to the Admin **Products** > **Catalog** configuration section can use a stored cross-site scripting vulnerability to embed malicious code.

An authenticated user with privileges to the Admin product configurations section can use a stored cross-site scripting vulnerability to embed malicious code.

An attacker can delete the content of wyswig directory within the context of authenticated administrator's session via cross-site request forgery.

Send to a friend page can be used for spamming due to missing CAPTCHA

Magento 2.x default configuration allows public access to custom PHP settings.

An authenticated user canview Personally identifiable details of another user via exploiting an Insecure Direct Object References vulnerability

Exception error reports capture administrative credentials in clear text format

An authenticated user can enumerate and access unauthorized wishlist via insecure direct object reference in the application.

An authenticated user can add and execute a malicious script on an HTML page through a vulnerable CLI command due to lack ofdata validation.