PT-2019-18902 · Adobe · Magento

Publicado 2019-11-05 · Atualizado 2021-07-21 · CVE-2019-8126

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Média

Vetor base

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Magento 2.2 versions prior to 2.2.10 Magento 2.3 versions prior to 2.3.3 or 2.3.2-p1

Description An XML entity injection issue exists, allowing an authenticated admin user to craft a document type definition for an XML representing XML layout. The crafted document type definition and XML layout enable the processing of external entities, which can lead to information disclosure.

Recommendations For Magento 2.2 versions prior to 2.2.10, update to version 2.2.10 or later. For Magento 2.3 versions prior to 2.3.3, update to version 2.3.3 or later. For Magento 2.3 version 2.3.2-p1, update to version 2.3.2-p2 or later.

Exploit

Correção

XML Entity Expansion

XXE

Enumeração de Fraquezas

CWE-776

CWE-611

Identificadores relacionados

CVE-2019-8126

GHSA-427G-2R83-3CCM

Produtos afetados

Magento

Referências · 6

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/magento/product-community-edition/CVE-2019-8126.yaml · Exploit
• https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-427g-2r83-3ccm · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-8126 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-8126 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-8126 · Nota