GitHub Advisoryadvisory · Packagist

GHSA-9wr9-fw9v-8fgr Magento 2 Community Edition RCE Vulnerability

HIGH Published 2022-05-24 Modified 2023-09-26 Official page ↗
Aliases
CVE-2019-8141
Ecosystem
Packagist
Packages
magento/community-edition
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-502
Reviewed
2023-07-18

Affected packages

• Packagist magento/community-edition: >= 2.1.0, < 2.1.19 → fixed in 2.1.19 • Packagist magento/community-edition: >= 2.2.0, < 2.2.10 → fixed in 2.2.10 • Packagist magento/community-edition: >= 2.3.0, < 2.3.3 → fixed in 2.3.3

Description

A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3. An authenticated user with administrative privileges (system level import) can execute arbitrary code through a Phar deserialization vulnerability in the import functionality.

Related

Alias · CVE (1)

  • CVE-2019-8141 A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3. vulnerability

Weakness · CWE (1)

  • CWE-502 Deserialization of Untrusted Data weakness

References