GitHub Advisoryadvisory · Packagist

GHSA-w3r8-fxv5-58pp Magento 2 Community Edition RCE Vulnerability via SSRF

HIGH Published 2022-05-24 Modified 2024-02-12 Official page ↗
Aliases
CVE-2019-7892
Ecosystem
Packagist
Packages
magento/community-edition
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Weaknesses
CWE-918
Reviewed
2023-07-17

Affected packages

• Packagist magento/community-edition: >= 2.1, < 2.1.18 → fixed in 2.1.18 • Packagist magento/community-edition: >= 2.2, < 2.2.9 → fixed in 2.2.9 • Packagist magento/community-edition: >= 2.3, < 2.3.2 → fixed in 2.3.2

Description

A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with administrator privileges to access shipment settings can execute arbitrary code via server-side request forgery.

Related

Alias · CVE (1)

  • CVE-2019-7892 A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. vulnerability

Weakness · CWE (1)

  • CWE-918 Server-Side Request Forgery weakness

References