Magento Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vulnerability - CVE-2016-10704 - Vulnerability Database

Magento

Magento Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vulnerability - CVE-2016-10704

Medium

Reference: CVE-2016-10704

NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2016-10704

Title: Magento Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) Vulnerability

Overview:

Magento Community Edition and Enterprise Edition before 2.0.10 and 2.1.x before 2.1.2 have XSS via e-mail templates that are mishandled during a preview aka APPSEC-1503.