GitHub Advisoryadvisory · Packagist

GHSA-qp43-2vhf-cj8g Magento Remote code execution through support/output path modification

HIGH Published 2022-05-24 Modified 2024-01-10 Official page ↗
Aliases
CVE-2019-8230
Ecosystem
Packagist
Packages
magento/core
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-94
Reviewed
2024-01-10

Affected packages

• Packagist magento/core: < 1.9.4.3 → fixed in 1.9.4.3

Description

In Magento Open Source prior to 1.9.4.3, and Magento Commerce prior to 1.14.4.3, an authenticated user with administrative privileges to edit configuration settings can execute arbitrary code through a crafted support/output path.

Related

Alias · CVE (1)

  • CVE-2019-8230 In Magentoprior to 1.9.4.3, and Magento prior to 1.14.4.3, an authenticated user with administrative privileges to edit configuration… vulnerability

Weakness · CWE (1)

  • CWE-94 Improper Control of Generation of Code weakness

References