PT-2019-18827 · Adobe · Magento

Publicado 2019-08-02 · Atualizado 2022-05-24 · CVE-2019-7925

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Média

Vetor base

AV:N/AC:L/Au:S/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions Magento 2.1 versions prior to 2.1.18 Magento 2.2 versions prior to 2.2.9 Magento 2.3 versions prior to 2.3.2

Description An insecure direct object reference (IDOR) issue exists, allowing an administrator with limited privileges to delete the downloadable products folder.

Recommendations For Magento 2.1 versions prior to 2.1.18, update to version 2.1.18 or later. For Magento 2.2 versions prior to 2.2.9, update to version 2.2.9 or later. For Magento 2.3 versions prior to 2.3.2, update to version 2.3.2 or later.

Exploit

Correção

IDOR

Path traversal

Enumeração de Fraquezas

CWE-639

CWE-22

Identificadores relacionados

CVE-2019-7925

GHSA-7G5J-Q8QJ-8984

Produtos afetados

Magento

Referências · 7

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/magento/product-community-edition/CVE-2019-7925.yaml · Exploit
• https://github.com/magento/magento2 · Nota
• https://osv.dev/vulnerability/CVE-2019-7925 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-7925 · Nota de Segurança
• https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-7925 · Nota
• https://osv.dev/vulnerability/GHSA-7g5j-q8qj-8984 · Aviso do Fabricante