CVE-2019-7876 — Magento vulnerability

5 documents5 sources
Severity
8.8HIGHNVD
EPSS
0.8%
top 25.24%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
MagentoMagento Community-editionMagento Product-community-edition+1 more
Timeline
PublishedAug 2
Latest updateMay 24

Description

A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with privileges to manipulate layouts can insert a malicious payload into the layout.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages4 packages

▶NVDmagento/magento2.1.0 — 2.1.18+2
▶Packagistmagento/community-edition2.1 — 2.1.18+2
▶Packagistmagento/product-community-edition2.1 — 2.1.18+2
▶CVEListV5adobe_systems_incorporated/magento_2Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2

🔴Vulnerability Details

3
GHSA
Magento 2 Community Edition RCE Vulnerability↗2022-05-24
▶
OSV
Magento 2 Community Edition RCE Vulnerability↗2022-05-24
▶
CVEList
CVE-2019-7876: A remote code execution vulnerability exists in Magento 2↗2019-08-02
▶

💬Community

1
Bugzilla
CVE-2019-7581 ming: Memory allocation failure in parseSWF_ACTIONRECORD function in util/parser.c↗2019-02-11
▶
CVE-2019-7876 — Magento vulnerability | cvebase