GitHub Advisoryadvisory · Packagist

GHSA-3q5x-7mxp-rp6j Remote code execution via vulnerable Symphony dependecy injection

CRITICAL Published 2019-11-12 Modified 2024-02-12 Official page ↗
Aliases
CVE-2019-8135
Ecosystem
Packagist
Packages
magento/community-edition
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-74
Reviewed
2019-11-12

Affected packages

• Packagist magento/community-edition: >= 2.2, < 2.2.10 → fixed in 2.2.10 • Packagist magento/community-edition: >= 2.3, < 2.3.2-p2 → fixed in 2.3.2-p2

Description

A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. Dependency injection through Symphony framework allows service identifiers to be derived from user controlled data, which can lead to remote code execution. As per the Magento Release 2.3.3, if you have already implemented the pre-release version of this patch (2.3.2-p1), it is highly recommended to promptly upgrade to 2.3.2-p2.

Related

Alias · CVE (1)

  • CVE-2019-8135 A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. vulnerability

Weakness · CWE (1)

  • CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component weakness

References