Remote code execution

2019-11-0600:15:00

PRIOn knowledge base

www.prio-n.com

7.3 High

AI Score

Confidence

High

0.002 Low

EPSS

Percentile

64.7%

JSON

A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3. An authenticated user with administrative privileges (system level import) can execute arbitrary code through a Phar deserialization vulnerability in the import functionality.

CPENameOperatorVersion
magentoge2.3.0
magentolt2.3.2
magentoge2.2.0
magentolt2.2.10
magentoge2.2.0
magentolt2.2.10
magentoge2.1.0
magentolt2.1.19
magentoge2.1.0
magentolt2.1.19