CVE-2019-8158: XML Injection (aka Blind XPath Injection)

An XPath entity injection vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An attacker can craft a GET request to page cache block rendering module that gets passed to XML data processing engine without validation. The crafted key/value GET request data...

PT-2019-18934

Name of the Vulnerable Software and Affected Versions Magento 2.2 versions 2.2.0 through 2.2.9 Magento 2.3 versions 2.3.0 through 2.3.2 Description An XPath entity injection issue exists, allowing an attacker to craft a GET request to the page cache block rendering module. This request gets passe...