Description

An arbitrary file deletion vulnerability exists in Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3. An authenticated users can manipulate the design layout update feature.

Remediation

References

CVE-2019-8090

Related Vulnerabilities

Internet Information Services Other Vulnerability (CVE-2001-0545)

WordPress Plugin Wise Chat CSV Injection (2.8.3)

Ampache Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2023-0771)

MODX Improper Control of Generation of Code ('Code Injection') Vulnerability (CVE-2017-7321)

OpenSSL Improper Input Validation Vulnerability (CVE-2008-5077)

Severity

Medium

Classification

CVE-2019-8090 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Tags

Missing Update Known Vulnerabilities