PT-2019-18909 · Adobe · Magento

Published 2019-11-05 · Updated 2020-08-24 · CVE-2019-8133

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Magento 2.2 versions prior to 2.2.10 Magento 2.3 versions prior to 2.3.3 or 2.3.2-p1, excluding 2.3.2-p1

Description A security bypass issue exists, allowing a user with sitemap generation privileges to bypass directory access restrictions. This bypass can lead to the overwrite of certain configuration files, resulting in denial of service.

Recommendations For Magento 2.2 versions prior to 2.2.10, upgrade to version 2.2.10 or later. For Magento 2.3 versions prior to 2.3.3, upgrade to version 2.3.3 or later. For Magento 2.3 version 2.3.2-p1, upgrade to 2.3.2-p2.

Exploit

Fix

Related Identifiers

CVE-2019-8133

GHSA-62FX-3V4F-MWXM

Affected Products

Magento

References · 6

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/magento/product-community-edition/CVE-2019-8133.yaml · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-8133 · Security Note
• https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-62fx-3v4f-mwxm · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-8133 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-8133 · Note