CVE-2019-8134

2019-11-0600:15:10

Google

osv.dev

8.2 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

30.8%

JSON

A SQL injection vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. A user with marketing privileges can execute arbitrary SQL queries in the database when accessing email template variables.

CPENameOperatorVersion
devdocseq2.1.17
devdocseq2.3.0
devdocseq2.2.7
devdocseq2.1.16
devdocseq2.3.1
devdocseq2.2.8

Name	Operator	Version
devdocs	eq	2.1.17
devdocs	eq	2.3.0
devdocs	eq	2.2.7
devdocs	eq	2.1.16
devdocs	eq	2.3.1
devdocs	eq	2.2.8

References

magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update