Magento Unrestricted file upload vulnerability

2022-05-2417:00:27

Google

osv.dev

6.7 Medium

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

38.6%

JSON

An unrestricted file upload vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated admin user can manipulate the Synchronization feature in the Media File Storage of the database to transform uploaded JPEG file into a PHP file.

CPENameOperatorVersion
magento/community-editioneq2.2.2
magento/community-editioneq2.2.1
magento/community-editioneq2.2.5
magento/community-editioneq2.3.2
magento/community-editioneq2.2.4
magento/community-editioneq2.2.9
magento/community-editioneq2.2.8
magento/community-editioneq2.3.2-p2
magento/community-editioneq2.2.6
magento/community-editioneq2.2.7

Name	Operator	Version
magento/community-edition	eq	2.2.2
magento/community-edition	eq	2.2.1
magento/community-edition	eq	2.2.5
magento/community-edition	eq	2.3.2
magento/community-edition	eq	2.2.4
magento/community-edition	eq	2.2.9
magento/community-edition	eq	2.2.8
magento/community-edition	eq	2.3.2-p2
magento/community-edition	eq	2.2.6
magento/community-edition	eq	2.2.7