An administrator with limited privileges could have had inserted script into the detailed rating, which could potentially result in stored cross-site scripting that affects other administrators.
Part of security update MAGENTO 2.2.3, 2.1.12 AND 2.0.18 SECURITY UPDATE
This vulnerability affects the following application versions:
- Magento 2.2.0
- Magento 2.2.0-rc2.0
- Magento 2.2.0-rc2.1
- Magento 2.2.0-rc2.2
- Magento 2.2.0-rc2.3
- Magento 2.2.0-rc3.0
- Magento 2.2.0-RC1.3
- Magento 2.2.0-RC1.4
- Magento 2.2.0-RC1.5
- Magento 2.2.0-RC1.6
- Magento 2.2.1
- Magento 2.2.2