PT-2019-18911 · Adobe · Magento

Publicado 2019-11-05 · Atualizado 2019-11-12 · CVE-2019-8135

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Magento 2.2 versions prior to 2.2.10 Magento 2.3 versions prior to 2.3.3 or 2.3.2-p1

Description A remote code execution issue exists due to dependency injection through the Symphony framework, allowing service identifiers to be derived from user-controlled data. This can lead to remote code execution.

Recommendations For Magento 2.2 versions prior to 2.2.10, update to version 2.2.10 or later. For Magento 2.3 versions prior to 2.3.3, update to version 2.3.3 or later. For Magento 2.3 version 2.3.2-p1, update to version 2.3.2-p2.

Exploit

Correção

RCE

Special Elements Injection

Enumeração de Fraquezas

CWE-74

Identificadores relacionados

CVE-2019-8135

GHSA-3Q5X-7MXP-RP6J

Produtos afetados

Magento

Referências · 6

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/magento/product-community-edition/CVE-2019-8135.yaml · Exploit
• https://osv.dev/vulnerability/CVE-2019-8135 · Aviso do Fabricante
• https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-8135 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-8135 · Nota
• https://osv.dev/vulnerability/GHSA-3q5x-7mxp-rp6j · Aviso do Fabricante