GitHub Advisoryadvisory · Packagist
GHSA-653q-vqm6-gmjm Magento 2 Community Edition Arbitrary File Deletion
MEDIUM
Official page ↗
- Aliases
- CVE-2019-8090
- Ecosystem
- Packagist
- Packages
- magento/community-edition
- Severity
- Moderate
- CVSS vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
- Reviewed
- 2023-07-18
Affected packages
• Packagist magento/community-edition: >= 2.2.0, < 2.2.10 → fixed in 2.2.10
• Packagist magento/community-edition: >= 2.3.0, < 2.3.3 → fixed in 2.3.3
Description
An arbitrary file deletion vulnerability exists in Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3. An authenticated users can manipulate the design layout update feature.
Related
Alias · CVE (1)
- CVE-2019-8090 An arbitrary file deletion vulnerability exists in Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3. vulnerability
References
- https://nvd.nist.gov/vuln/detail/CVE-2019-8090 advisory
- https://github.com/FriendsOfPHP/security-advisories/blob/master/magento/product-community-edition/CVE-2019-8090.yaml web
- https://github.com/magento/magento2 package
- https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update web
- https://web.archive.org/web/20220121051105/https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update web