JavaScript code that is passed using the Payflow Pro payment module was not sanitized but was saved to the database. This issue by itself was not a security risk. (This issue is related to APPSEC-1239.)
Part of patch MAGENTO 2.0.1 SECURITY UPDATE
This vulnerability affects the following application versions:
- Magento 2.0.0
- Magento 2.0.0-rc
- Magento 2.0.0-rc2