PT-2019-18909 · Adobe · Magento

Publicado 2019-11-05 · Atualizado 2020-08-24 · CVE-2019-8133

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Magento 2.2 versions prior to 2.2.10 Magento 2.3 versions prior to 2.3.3 or 2.3.2-p1, excluding 2.3.2-p1

Description A security bypass issue exists, allowing a user with sitemap generation privileges to bypass directory access restrictions. This bypass can lead to the overwrite of certain configuration files, resulting in denial of service.

Recommendations For Magento 2.2 versions prior to 2.2.10, upgrade to version 2.2.10 or later. For Magento 2.3 versions prior to 2.3.3, upgrade to version 2.3.3 or later. For Magento 2.3 version 2.3.2-p1, upgrade to 2.3.2-p2.

Exploit

Correção

Identificadores relacionados

CVE-2019-8133

GHSA-62FX-3V4F-MWXM

Produtos afetados

Magento

Referências · 6

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/magento/product-community-edition/CVE-2019-8133.yaml · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-8133 · Nota de Segurança
• https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-62fx-3v4f-mwxm · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-8133 · Aviso do Fabricante
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-8133 · Nota