GitHub Advisoryadvisory · Packagist
GHSA-hqhf-8jgc-h5hx Magento 2 Community Edition Path Traversal Vulnerability
HIGH
Official page ↗
- Aliases
- CVE-2019-7859
- Ecosystem
- Packagist
- Packages
- magento/community-edition
- Severity
- High
- CVSS vector
- CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- Weaknesses
- CWE-22
- Reviewed
- 2023-07-17
Affected packages
• Packagist magento/community-edition: >= 2.1.0, < 2.1.18 → fixed in 2.1.18
• Packagist magento/community-edition: >= 2.2.0, < 2.2.9 → fixed in 2.2.9
• Packagist magento/community-edition: >= 2.3.0, < 2.3.2 → fixed in 2.3.2
Description
A path traversal vulnerability in the WYSIWYG editor for Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 could result in unauthorized access to uploaded images due to insufficient access control.
Related
Alias · CVE (1)
- CVE-2019-7859 A path traversal vulnerability in the WYSIWYG editor for Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to… vulnerability
Weakness · CWE (1)
- CWE-22 Improper Limitation of a Pathname to a Restricted Directory weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2019-7859 advisory
- https://github.com/FriendsOfPHP/security-advisories/blob/master/magento/product-community-edition/CVE-2019-7859.yaml web
- https://github.com/magento/magento2 package
- https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23 web
- https://web.archive.org/web/20220127030535/https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-24 web