Description

A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with privileges to modify product catalogs can trigger PHP file inclusion through a crafted XML file that specifies product design update.

Remediation

References

CVE-2019-8154

Related Vulnerabilities

WordPress Plugin Import any XML or CSV File to WordPress Arbitrary File Upload (3.6.7)

MySQL CVE-2024-21162 Vulnerability (CVE-2024-21162)

Atlassian Jira Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2019-20411)

Plone CMS URL Redirection to Untrusted Site ('Open Redirect') Vulnerability (CVE-2020-7936)

MediaWiki Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2023-37255)

Severity

High

Classification

CVE-2019-8154 CWE-829 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities