Lucene search

GitHub Advisory DatabaseGHSA-4J6W-9RF8-HG7R

HistoryMay 24, 2022 - 10:00 p.m.

Magento 2 Community Edition SQLi Vulnerability

2022-05-2422:00:38

CWE-89

GitHub Advisory Database

github.com

magento

community edition

sql injection

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.099

Percentile

94.9%

JSON

An unauthenticated user can execute SQL statements that allow arbitrary read access to the underlying database, which causes sensitive data leakage. This issue is fixed in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2.

Affected configurations

Vulners

Node

magentocommunity-editionRange2.3.0–2.3.2

magentocommunity-editionRange2.2.0–2.2.9

magentocommunity-editionRange2.1.0–2.1.18

VendorProductVersionCPE
magentocommunity-edition*cpe:2.3:a:magento:community-edition:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
magento	community-edition	*	cpe:2.3:a:magento:community-edition::::::::

References

github.com/advisories/GHSA-4j6w-9rf8-hg7r

github.com/FriendsOfPHP/security-advisories/blob/master/magento/magento1ce/CVE-2019-7139.yaml

github.com/FriendsOfPHP/security-advisories/blob/master/magento/magento1ee/CVE-2019-7139.yaml

github.com/FriendsOfPHP/security-advisories/blob/master/magento/product-community-edition/CVE-2019-7139.yaml

magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13

magento.com/security/patches/supee-11086

nvd.nist.gov/vuln/detail/CVE-2019-7139

web.archive.org/web/20211206084839/https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13

www.ambionics.io/blog/magento-sqli

CVSS2

7.5

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS3

9.8

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

0.099

Percentile

94.9%

JSON

Related for GHSA-4J6W-9RF8-HG7R