GHSA-6qh6-v99h-vh4c
Magento 2 Community Edition RCE Vulnerability
At a glance
- Published
- Updated
- CVE
- CVE-2019-7876
- CVSS_V3
- CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Description
A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with privileges to manipulate layouts can insert a malicious payload into the layout.
Affected packages
| Package | Versions |
|---|---|
| Packagist · magento/community-edition | introduced 2.1, fixed 2.1.18 |
| Packagist · magento/community-edition | introduced 2.2, fixed 2.2.9 |
| Packagist · magento/community-edition | introduced 2.3, fixed 2.3.2 |
| Packagist · magento/product-community-edition | introduced 2.1, fixed 2.1.18 |
| Packagist · magento/product-community-edition | introduced 2.2, fixed 2.2.9 |
| Packagist · magento/product-community-edition | introduced 2.3, fixed 2.3.2 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2019-7876 ADVISORY
- https://github.com/FriendsOfPHP/security-advisories/blob/master/magento/product-community-edition/CVE-2019-7876.yaml WEB
- https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13 WEB
- https://web.archive.org/web/20211206084839/https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |