GitHub Advisoryadvisory · Packagist
GHSA-vvf9-fxhv-4rgj Magento 2 Community Edition RCE
HIGH
Official page ↗
- Aliases
- CVE-2019-7942
- Ecosystem
- Packagist
- Packages
- magento/community-edition
- Severity
- High
- CVSS vector
- CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- Weaknesses
- CWE-94
- Reviewed
- 2023-07-14
Affected packages
• Packagist magento/community-edition: >= 2.1.0, < 2.1.18 → fixed in 2.1.18
• Packagist magento/community-edition: >= 2.2.0, < 2.2.9 → fixed in 2.2.9
• Packagist magento/community-edition: >= 2.3.0, < 2.3.2 → fixed in 2.3.2
Description
A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with admin privileges to create or edit a product can execute arbitrary code via malicious XML layout updates.
Related
Alias · CVE (1)
- CVE-2019-7942 A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. vulnerability
Weakness · CWE (1)
- CWE-94 Improper Control of Generation of Code weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2019-7942 advisory
- https://github.com/FriendsOfPHP/security-advisories/blob/master/magento/product-community-edition/CVE-2019-7942.yaml web
- https://github.com/magento/magento2 package
- https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13 web
- https://web.archive.org/web/20211206084839/https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13 web