Apply the Magento 2.2.5/2.1.14 Security Update immediately. Review your site for signs of compromise. Find more information about Security Best Practices.
This issue is reported in a security report by the security scan tool for Magento Ver. 2.3.6 and there is no patch available at the download link but the complete release of Magento 2.2.5.
Scan Name: XS Vulnerability