[PRODSECBUG-2515] Stored cross-site scripting through transactional emails page when creating new email template – CVE-2019-8228

An authenticated user with limited administrative privileges could inject arbitrary JavaScript code into transactional email page when creating a new email template or editing existing email template.

Part of update SUPEE-11219

This vulnerability affects the following application versions:

• Magento 1.9.1.1
• Magento 1.9.2.0
• Magento 1.9.2.1
• Magento 1.9.2.2
• Magento 1.9.2.3
• Magento 1.9.2.4
• Magento 1.9.3.0
• Magento 1.9.3.1
• Magento 1.9.3.2
• Magento 1.9.3.3
• Magento 1.9.3.4
• Magento 1.9.3.6
• Magento 1.9.3.7
• Magento 1.9.3.8
• Magento 1.9.3.9
• Magento 1.9.3.10
• Magento 1.9.4.0
• Magento 1.9.4.1
• Magento 1.9.4.2