Description

A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with admin privileges to layouts can execute arbitrary code through a crafted XML layout update.

Remediation

References

CVE-2019-7895

Related Vulnerabilities

WordPress Plugin WordPress Bitcoin Payments-Blockonomics Cross-Site Scripting (3.2)

MyBB Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2021-43281)

WordPress Plugin Ninja Forms Contact Form-The Drag and Drop Form Builder for WordPress Multiple Cross-Site Scripting Vulnerabilities (2.9.21)

MySQL CVE-2019-2580 Vulnerability (CVE-2019-2580)

WordPress Plugin BBS e-Franchise SQL Injection (1.1.1)

Severity

High

Classification

CVE-2019-7895 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities