CVE-2019-8158

CVE-2019-8158 affects Magento: Magento 2.2 prior to 2.2.10 and 2.3 prior to 2.3.3 (or 2.3.2-p1). The issue is an XPath entity injection in the page cache block rendering path, where crafted GET data is passed to the XML data processing engine without validation, allowing limited access to underly...