PT-2019-18930 · Adobe · Magento

Published 2019-11-05 · Updated 2024-10-20 · CVE-2019-8154

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Magento versions 2.2 prior to 2.2.10 Magento versions 2.3 prior to 2.3.3 or 2.3.2-p1 Magento versions prior to 3.1.2

Description A remote code execution vulnerability exists, allowing an authenticated user with privileges to modify product catalogs to trigger PHP file inclusion through a crafted XML file that specifies product design update. This issue can be exploited by including malicious PHP files.

Recommendations For Magento 2.2 prior to 2.2.10, update to version 2.2.10 or later. For Magento 2.3 prior to 2.3.3 or 2.3.2-p1, update to version 2.3.3 or 2.3.2-p2. For Magento versions prior to 3.1.2, update to version 3.1.2 or later. As a temporary workaround, consider restricting access to product catalog modification privileges to minimize the risk of exploitation.

Exploit

Fix

RCE

Weakness Enumeration

CWE-829

Related Identifiers

CVE-2019-8154

GHSA-4V2Q-HJX3-C4VR

Affected Products

Magento

References · 10

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/magento/product-community-edition/CVE-2019-8154.yaml · Exploit
• https://osv.dev/vulnerability/GHSA-4v2q-hjx3-c4vr · Vendor Advisory
• https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-8154 · Security Note
• https://osv.dev/vulnerability/CVE-2019-8154 · Vendor Advisory
• https://github.com/magento/magento2 · Note
• https://twitter.com/transilienceai/status/1848052937215369520 · Twitter Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-8154 · Note
• https://twitter.com/transilienceai/status/1846962072044916846 · Twitter Post
• https://twitter.com/transilienceai/status/1847325678305149170 · Twitter Post