CVEvulnerability
CVE-2019-7859
7.5 HIGH
Official page ↗
- Status
- Modified
- Published
- 2019-08-02
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 7.5 HIGH — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- CVSS 2.0 ([email protected])
- 5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-22
Description
A path traversal vulnerability in the WYSIWYG editor for Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 could result in unauthorized access to uploaded images due to insufficient access control.
Affected configurations
• magento magento (>= 2.1.0 < 2.1.18)
• magento magento (>= 2.2.0 < 2.2.9)
• magento magento (>= 2.3.0 < 2.3.2)
Related
Weakness · CWE (1)
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness
References
- https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-24 Not Applicable, Vendor Advisory
- https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23 Vendor Advisory
- https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-24 Not Applicable, Vendor Advisory