PT-2019-18902 · Adobe · Magento

Published 2019-11-05 · Updated 2021-07-21 · CVE-2019-8126

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Magento 2.2 versions prior to 2.2.10 Magento 2.3 versions prior to 2.3.3 or 2.3.2-p1

Description An XML entity injection issue exists, allowing an authenticated admin user to craft a document type definition for an XML representing XML layout. The crafted document type definition and XML layout enable the processing of external entities, which can lead to information disclosure.

Recommendations For Magento 2.2 versions prior to 2.2.10, update to version 2.2.10 or later. For Magento 2.3 versions prior to 2.3.3, update to version 2.3.3 or later. For Magento 2.3 version 2.3.2-p1, update to version 2.3.2-p2 or later.

Exploit

Fix

XML Entity Expansion

XXE

Weakness Enumeration

CWE-776

CWE-611

Related Identifiers

CVE-2019-8126

GHSA-427G-2R83-3CCM

Affected Products

Magento

References · 6

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/magento/product-community-edition/CVE-2019-8126.yaml · Exploit
• https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-427g-2r83-3ccm · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-8126 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-8126 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-8126 · Note