From 3f79b711a4cfcd737bbe9a197e60e9b55b9199f0 Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Fri, 14 Jul 2023 23:54:19 +0000
Subject: [PATCH] Publish Advisories

GHSA-525g-rvh4-v5c9
GHSA-525g-rvh4-v5c9
---
 .../GHSA-525g-rvh4-v5c9.json                  | 95 +++++++++++++++++++
 .../GHSA-525g-rvh4-v5c9.json                  | 35 -------
 2 files changed, 95 insertions(+), 35 deletions(-)
 create mode 100644 advisories/github-reviewed/2022/05/GHSA-525g-rvh4-v5c9/GHSA-525g-rvh4-v5c9.json
 delete mode 100644 advisories/unreviewed/2022/05/GHSA-525g-rvh4-v5c9/GHSA-525g-rvh4-v5c9.json

diff --git a/advisories/github-reviewed/2022/05/GHSA-525g-rvh4-v5c9/GHSA-525g-rvh4-v5c9.json b/advisories/github-reviewed/2022/05/GHSA-525g-rvh4-v5c9/GHSA-525g-rvh4-v5c9.json
new file mode 100644
index 00000000000..3a977a207db
--- /dev/null
+++ b/advisories/github-reviewed/2022/05/GHSA-525g-rvh4-v5c9/GHSA-525g-rvh4-v5c9.json
@@ -0,0 +1,95 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-525g-rvh4-v5c9",
+  "modified": "2023-07-14T23:53:06Z",
+  "published": "2022-05-24T16:52:27Z",
+  "aliases": [
+    "CVE-2019-7926"
+  ],
+  "summary": "Magento 2 Community Edition XSS Vulnerability",
+  "details": "A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with privileges to modify node attributes to inject malicious javascript.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.0/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "magento/community-edition"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "2.1"
+            },
+            {
+              "fixed": "2.1.18"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "magento/community-edition"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "2.2"
+            },
+            {
+              "fixed": "2.2.9"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "magento/community-edition"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "2.3"
+            },
+            {
+              "fixed": "2.3.2"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-7926"
+    },
+    {
+      "type": "WEB",
+      "url": "https://web.archive.org/web/20220121051916/https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-79"
+    ],
+    "severity": "MODERATE",
+    "github_reviewed": true,
+    "github_reviewed_at": "2023-07-14T23:53:06Z",
+    "nvd_published_at": "2019-08-02T22:15:00Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2022/05/GHSA-525g-rvh4-v5c9/GHSA-525g-rvh4-v5c9.json b/advisories/unreviewed/2022/05/GHSA-525g-rvh4-v5c9/GHSA-525g-rvh4-v5c9.json
deleted file mode 100644
index 511f01f6481..00000000000
--- a/advisories/unreviewed/2022/05/GHSA-525g-rvh4-v5c9/GHSA-525g-rvh4-v5c9.json
+++ /dev/null
@@ -1,35 +0,0 @@
-{
-  "schema_version": "1.4.0",
-  "id": "GHSA-525g-rvh4-v5c9",
-  "modified": "2022-05-24T16:52:27Z",
-  "published": "2022-05-24T16:52:27Z",
-  "aliases": [
-    "CVE-2019-7926"
-  ],
-  "details": "A stored cross-site scripting vulnerability exists in the admin panel of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited by an authenticated user with privileges to modify node attributes to inject malicious javascript.",
-  "severity": [
-
-  ],
-  "affected": [
-
-  ],
-  "references": [
-    {
-      "type": "ADVISORY",
-      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-7926"
-    },
-    {
-      "type": "WEB",
-      "url": "https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23"
-    }
-  ],
-  "database_specific": {
-    "cwe_ids": [
-
-    ],
-    "severity": null,
-    "github_reviewed": false,
-    "github_reviewed_at": null,
-    "nvd_published_at": "2019-08-02T22:15:00Z"
-  }
-}
\ No newline at end of file