CVE-2019-7859 — Path Traversal in Magento

CWE-22 — Path Traversal4 documents4 sources
Severity
7.5HIGHNVD
EPSS
0.1%
top 66.01%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
MagentoMagento Community-editionAdobe Systems Incorporated Magento 2
Timeline
PublishedAug 2
Latest updateMay 24

Description

A path traversal vulnerability in the WYSIWYG editor for Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 could result in unauthorized access to uploaded images due to insufficient access control.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages3 packages

▶NVDmagento/magento2.1.0 — 2.1.18+2
▶Packagistmagento/community-edition2.1.0 — 2.1.18+2
▶CVEListV5adobe_systems_incorporated/magento_2Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2

🔴Vulnerability Details

3
OSV
Magento 2 Community Edition Path Traversal Vulnerability↗2022-05-24
▶
GHSA
Magento 2 Community Edition Path Traversal Vulnerability↗2022-05-24
▶
CVEList
CVE-2019-7859: A path traversal vulnerability in the WYSIWYG editor for Magento 2↗2019-08-02
▶
CVE-2019-7859 — Path Traversal in Magento | cvebase