CVE-2019-8158

🗓️ 06 Nov 2019 00:03:49Reported by adobeType

XPath entity injection vulnerability in Magento 2.2/2.3-prior to 2.2.10/2.3.3/2.3.2-p1. Attacker can craft GET request to page cache block rendering module for XML data processing engine without validation, leading to limited access to underlying XML data

Reporter	Title	Published	Views	Family All 10
Circl	CVE-2019-8158	5 Feb 202408:41	–	circl
Cvelist	CVE-2019-8158	6 Nov 201900:03	–	cvelist
EUVD	EUVD-2022-3208	3 Oct 202520:07	–	euvd
Friends Of PHP	PRODSECBUG-2272: XPath Injection via front end rendering functionality	8 Oct 201900:00	–	friendsofphp
Github Security Blog	Magento 2 Community Edition XML Injection	24 May 202217:00	–	github
NVD	CVE-2019-8158	6 Nov 201901:15	–	nvd
OpenVAS	Magento 2.2.x < 2.2.10, 2.3.x < 2.3.3 or 2.3.2-p1 Multiple Vulnerabilities (Oct 2019)	7 Nov 201900:00	–	openvas
OSV	GHSA-8P5C-F836-M4H7 Magento 2 Community Edition XML Injection	24 May 202217:00	–	osv
Prion	Design/Logic Flaw	6 Nov 201901:15	–	prion
RedhatCVE	CVE-2019-8158	22 May 202508:53	–	redhatcve

NVD

Vulners

Node

magento magentoRange2.2.0–2.2.10commerce

magento magentoRange2.2.0–2.2.10open_source

magento magentoRange2.3.0–2.3.2commerce

magento magentoRange2.3.0–2.3.2open_source

magento magentoMatch2.3.2-commerce

magento magentoMatch2.3.2-open_source

[
  {
    "product": "Magento 2",
    "vendor": "Adobe Systems Incorporated",
    "versions": [
      {
        "status": "affected",
        "version": "Magento 2.2 prior to 2.2.10"
      },
      {
        "status": "affected",
        "version": "Magento 2.3 prior to 2.3.3 or 2.3.2-p1"
      }
    ]
  }
]

Source	Link
magento	www.magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update

21 Nov 2024 04:49Current

9.3High risk

Vulners AI Score9.3

CVSS 27.5

CVSS 3.19.8

EPSS0.00157

CWE-91