CVE-2019-8129: Magento Cross-Site Scripting via Signifyd Guarantee Option Translation Override
5.4
CVSS Score
3.1
Basic Information
CVE ID
GHSA ID
EPSS Score
0.39525%
CWE
Published
5/24/2022
Updated
5/15/2024
KEV Status
No
Technology
PHP
Technical Details
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| magento/community-edition | composer | >= 2.2, < 2.2.10 | 2.2.10 |
| magento/community-edition | composer | >= 2.3, < 2.3.2-p1 | 2.3.2-p2 |
Vulnerability Intelligence
Miggo AI
Root Cause Analysis
The vulnerability stems from improper output escaping of user-controlled translated strings. The Signifyd Guarantee feature uses a translation key that can be overridden via the admin panel. When the translated message is retrieved (via __() or equivalent) and rendered in the template without proper escaping (e.g., using $escaper->escapeHtml), it allows XSS payloads to execute. The block method responsible for delivering the message to the template would be the logical point of failure. While exact code isn't available, Magento's translation architecture and the vulnerability description strongly suggest this pattern.