GHSA-6qh6-v99h-vh4c
Magento 2 Community Edition RCE Vulnerability
En bref
- Publiée
- Mise à jour
- CVE
- CVE-2019-7876
- CVSS_V3
- CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Description
A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with privileges to manipulate layouts can insert a malicious payload into the layout.
Paquets affectés
| Paquet | Versions |
|---|---|
| Packagist · magento/community-edition | introduced 2.1, fixed 2.1.18 |
| Packagist · magento/community-edition | introduced 2.2, fixed 2.2.9 |
| Packagist · magento/community-edition | introduced 2.3, fixed 2.3.2 |
| Packagist · magento/product-community-edition | introduced 2.1, fixed 2.1.18 |
| Packagist · magento/product-community-edition | introduced 2.2, fixed 2.2.9 |
| Packagist · magento/product-community-edition | introduced 2.3, fixed 2.3.2 |
Références
- https://nvd.nist.gov/vuln/detail/CVE-2019-7876 ADVISORY
- https://github.com/FriendsOfPHP/security-advisories/blob/master/magento/product-community-edition/CVE-2019-7876.yaml WEB
- https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13 WEB
- https://web.archive.org/web/20211206084839/https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |