Description
A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. Dependency injection through Symphony framework allows service identifiers to be derived from user controlled data, which can lead to remote code execution.
Remediation
References
Related Vulnerabilities
WordPress Plugin Compact WP Audio Player Cross-Site Scripting (1.9.7)
PostgreSQL Permissions, Privileges, and Access Controls Vulnerability (CVE-2010-1975)
WordPress Plugin WP Photo Album 'photo' Parameter SQL Injection (1.0)
WordPress Plugin NextGEN Gallery-WordPress Gallery 'xml/media-rss.php' Cross-Site Scripting (1.5.1)
WordPress Plugin All-In-One Security (AIOS)-Security and Firewall Cross-Site Request Forgery (3.8.9)