CVE-2019-8232
published 2019-11-06CVE-2019-8232: In Magento prior to 1.9.4.3, Magento prior to 1.14.4.3, Magento 2.2 prior to 2.2.10, and Magento 2.3 prior to 2.3.3 or 2.3.2-p1, an authenticated user with…
PriorityP335medium6.6CVSS 3.1
AVNACHPRHUINSUCHIHAH
EPSS
0.85%
53.7th percentile
In Magento prior to 1.9.4.3, Magento prior to 1.14.4.3, Magento 2.2 prior to 2.2.10, and Magento 2.3 prior to 2.3.3 or 2.3.2-p1, an authenticated user with administrative privileges for the import feature can execute arbitrary code through a race condition that allows webserver configuration file modification.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| adobe_systems_incorporated | magento_1_2 | — | — |
| magento | community-edition | >= 2.2.0 < 2.2.10 | 2.2.10 |
| magento | community-edition | >= 2.3.0 < 2.3.2-p1 | 2.3.2-p1 |
| magento | magento | — | — |
| magento | magento | >= 1.5.0.0 < 1.9.4.3 | 1.9.4.3 |
| magento | magento | >= 1.9.0.0 < 1.14.4.3 | 1.14.4.3 |
| magento | magento | >= 2.2.0 < 2.2.10 | 2.2.10 |
| magento | magento | >= 2.3.0 < 2.3.2 | 2.3.2 |
CVSS provenance
nvdv3.16.6MEDIUMCVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.0MEDIUMAV:N/AC:M/Au:S/C:P/I:P/A:P
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Magento 2 Community Edition RCE Vulnerability
osv·2022-05-24
CVE-2019-8232 [MEDIUM] Magento 2 Community Edition RCE Vulnerability
Magento 2 Community Edition RCE Vulnerability
In Magento prior to 1.9.4.3, Magento prior to 1.14.4.3, Magento 2.2 prior to 2.2.10, and Magento 2.3 prior to 2.3.3 or 2.3.2-p1, an authenticated user with administrative privileges for the import feature can execute arbitrary code through a race condition that allows webserver configuration file modification.
GHSA
Magento 2 Community Edition RCE Vulnerability
ghsa·2022-05-24
CVE-2019-8232 [MEDIUM] CWE-362 Magento 2 Community Edition RCE Vulnerability
Magento 2 Community Edition RCE Vulnerability
In Magento prior to 1.9.4.3, Magento prior to 1.14.4.3, Magento 2.2 prior to 2.2.10, and Magento 2.3 prior to 2.3.3 or 2.3.2-p1, an authenticated user with administrative privileges for the import feature can execute arbitrary code through a race condition that allows webserver configuration file modification.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2019-11-06
Published