GHSA-w8vh-5v64-j3vr

Withdrawn Advisory: Magento 2 Community Edition RCE Vulnerability

Withdrawn · 2023-09-28 21:18 UTC

At a glance

Published: 2022-05-24 17:00 UTC
Updated: 2026-09-10 03:49 UTC
CVE: CVE-2019-8229
CVSS_V3: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Description

## Withdrawn Advisory This advisory has been withdrawn because the vulnerability does not affect a package in one of the GitHub Advisory Database's [supported ecosystems](https://github.com/github/advisory-database/blob/main/README.md#supported-ecosystems). This link is maintained to preserve external references. ## Original Description In Magento prior to 1.9.4.3, and Magento prior to 1.14.4.3, an authenticated user with administrative privileges to edit product attributes can execute arbitrary code through crafted layout updates.

Affected packages

Package	Versions
Packagist · magento/community-edition	introduced 0, fixed 1.9.4.3

References

https://nvd.nist.gov/vuln/detail/CVE-2019-8229 ADVISORY
https://web.archive.org/web/20211209030216/https://magento.com/security/patches/supee-11219 WEB

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — GitHub Advisory Database