PT-2019-18916 · Adobe · Magento

Published 2019-11-05 · Updated 2022-05-24 · CVE-2019-8140

Positive Technologies (AI Summary)

CVSS v3.1

4.9

Medium

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Magento 2.2 versions prior to 2.2.10 Magento 2.3 versions prior to 2.3.3 or 2.3.2-p1

Description An issue exists where an authenticated admin user can manipulate the Synchronization feature in the Media File Storage of the database. This allows transforming an uploaded JPEG file into a PHP file, exploiting an unrestricted file upload.

Recommendations For Magento 2.2 versions prior to 2.2.10, update to version 2.2.10 or later. For Magento 2.3 versions prior to 2.3.3, update to version 2.3.3 or later. For Magento 2.3 version 2.3.2, apply patch 2.3.2-p1 or later.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2019-8140

GHSA-7PR3-34RG-G53M

Affected Products

Magento

References · 7

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/magento/product-community-edition/CVE-2019-8140.yaml · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-8140 · Security Note
• https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-8140 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7pr3-34rg-g53m · Vendor Advisory
• https://github.com/magento/magento2 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-8140 · Note