PT-2019-18899 · Adobe · Magento

Published 2019-11-05 · Updated 2022-05-24 · CVE-2019-8123

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Magento 1 versions prior to 1.9.4.3 Magento 1 versions prior to 1.14.4.3 Magento 2.1 versions prior to 2.1.19 Magento 2.2 versions prior to 2.2.10 Magento 2.3 versions prior to 2.3.3

Description An insufficient logging and monitoring issue exists due to the logging feature not containing sufficient data to effectively track configuration changes.

Recommendations For Magento 1 versions prior to 1.9.4.3, update to version 1.9.4.3 or later. For Magento 1 versions prior to 1.14.4.3, update to version 1.14.4.3 or later. For Magento 2.1 versions prior to 2.1.19, update to version 2.1.19 or later. For Magento 2.2 versions prior to 2.2.10, update to version 2.2.10 or later. For Magento 2.3 versions prior to 2.3.3, update to version 2.3.3 or later, especially if the pre-release version of the patch (2.3.2-p1) has been implemented, in which case an upgrade to 2.3.2-p2 is highly recommended.

Exploit

Fix

Weakness Enumeration

CWE-778

Related Identifiers

CVE-2019-8123

GHSA-FP5M-4MQH-849P

Affected Products

Magento

References · 11

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/magento/magento1ce/CVE-2019-8123.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/magento/magento1ee/CVE-2019-8123.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/magento/product-community-edition/CVE-2019-8123.yaml · Exploit
• https://magento.com/security/patches/supee-11219 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-fp5m-4mqh-849p · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-8123 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-8123 · Security Note
• https://github.com/magento/magento2 · Note
• https://web.archive.org/web/20211209030216/https://magento.com/security/patches/supee-11219 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-8123 · Note
• https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update · Note