PT-2019-18786 · Adobe · Magento

Publicado 2019-08-02 · Atualizado 2022-05-24 · CVE-2019-7861

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Magento 2.1 prior to 2.1.18 Magento 2.2 prior to 2.2.9 Magento 2.3 prior to 2.3.2

Description The issue is related to insufficient server-side validation of user input, which could allow an attacker to bypass file upload restrictions.

Recommendations For Magento 2.1 prior to 2.1.18, update to version 2.1.18 or later. For Magento 2.2 prior to 2.2.9, update to version 2.2.9 or later. For Magento 2.3 prior to 2.3.2, update to version 2.3.2 or later.

Exploit

Correção

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2019-7861

GHSA-J837-VM6W-6QCV

Produtos afetados

Magento

Referências · 8

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/magento/product-community-edition/CVE-2019-7861.yaml · Exploit
• https://github.com/magento/magento2 · Nota
• https://osv.dev/vulnerability/GHSA-j837-vm6w-6qcv · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-7861 · Nota de Segurança
• https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13 · Aviso do Fabricante
• https://web.archive.org/web/20211206084839/https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-7861 · Nota
• https://osv.dev/vulnerability/CVE-2019-7861 · Aviso do Fabricante