Lucene search
GoogleOSV:GHSA-J63V-WCF9-C9HMHistoryMay 24, 2022 - 5:00 p.m.
Magento 2 Community Edition RCE Vulnerability
2022-05-2417:00:25
Google
osv.dev
1
0.003 Low
EPSS
Percentile
66.2%
A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3. An authenticated admin user with import product privileges can delete files through bulk product import and inject code into XSLT file. The combination of these manipulations can lead to remote code execution.
References
github.com/FriendsOfPHP/security-advisories/blob/master/magento/product-community-edition/CVE-2019-8119.yaml
github.com/magento/magento2
magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update
nvd.nist.gov/vuln/detail/CVE-2019-8119
web.archive.org/web/20220121051105/https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update
Related
github
github
Magento 2 Community Edition RCE Vulnerability
2022-05-24 17:00:25
osv
osv
CVE-2019-8119
2019-11-05 23:15:12
prion
prion
Remote code execution
2019-11-05 23:15:00
cvelist
cvelist
CVE-2019-8119
2019-11-05 22:49:18
nvd
nvd
CVE-2019-8119
2019-11-05 23:15:12
friendsofphp
friendsofphp
cve
cve
CVE-2019-8119
2019-11-05 23:15:12
openvas
openvas