Description

A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with privileges to modify product catalogs can trigger PHP file inclusion through a crafted XML file that specifies product design update.

Remediation

References

CVE-2019-8154

Related Vulnerabilities

Grafana Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2022-21702)

Oracle Database Server CVE-2014-4295 Vulnerability (CVE-2014-4295)

WordPress Plugin Widgets for SiteOrigin Unspecified Vulnerability (1.4.4)

Next.js Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2026-27978)

Apache Tomcat Allocation of Resources Without Limits or Throttling Vulnerability (CVE-2024-38286)

Severity

High

Classification

CVE-2019-8154 CWE-829 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities