Description

A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with administrator privileges to access shipment settings can execute arbitrary code via server-side request forgery.

Remediation

References

CVE-2019-7892

Related Vulnerabilities

Oracle Database Server Allocation of Resources Without Limits or Throttling Vulnerability (CVE-2018-10237)

WordPress Plugin Wholesale Market Arbitrary File Download (2.2.0)

Wordpress Plugin Backup Migration Inclusion of Functionality from Untrusted Control Sphere Vulnerability (CVE-2023-6971)

Drupal Core 4.5.x Cross-Site Scripting (4.5.0 - 4.5.7)

Jenkins Resource Management Errors Vulnerability (CVE-2014-3661)

Severity

High

Classification

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities CWE-918 CVE-2019-7892