PT-2019-18911 · Adobe · Magento

Published 2019-11-05 · Updated 2019-11-12 · CVE-2019-8135

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Magento 2.2 versions prior to 2.2.10 Magento 2.3 versions prior to 2.3.3 or 2.3.2-p1

Description A remote code execution issue exists due to dependency injection through the Symphony framework, allowing service identifiers to be derived from user-controlled data. This can lead to remote code execution.

Recommendations For Magento 2.2 versions prior to 2.2.10, update to version 2.2.10 or later. For Magento 2.3 versions prior to 2.3.3, update to version 2.3.3 or later. For Magento 2.3 version 2.3.2-p1, update to version 2.3.2-p2.

Exploit

Fix

RCE

Special Elements Injection

Weakness Enumeration

CWE-74

Related Identifiers

CVE-2019-8135

GHSA-3Q5X-7MXP-RP6J

Affected Products

Magento

References · 6

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/magento/product-community-edition/CVE-2019-8135.yaml · Exploit
• https://osv.dev/vulnerability/CVE-2019-8135 · Vendor Advisory
• https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-8135 · Security Note
• https://osv.dev/vulnerability/GHSA-3q5x-7mxp-rp6j · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-8135 · Note