Vulnerability advisory

GHSA-6qh6-v99h-vh4c

Magento 2 Community Edition RCE Vulnerability

Published May 24, 2022Updated Nov 28, 2024OSV record ↗

Also known as CVE-2019-7876

Severity

CVSS 3.xCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Affected versions

magento/community-edition Packagist

All magento/community-edition advisories →

Affected	Fixed in
`2.1` to before 2.1.18	`2.1.18`Advisories →
Also listed as affected (21) `2.1.0` `2.1.0-rc1` `2.1.0-rc2` `2.1.0-rc3` `2.1.1` `2.1.10` `2.1.11` `2.1.12` `2.1.13` `2.1.14` `2.1.15` `2.1.16` `2.1.17` `2.1.2` `2.1.3` `2.1.4` `2.1.5` `2.1.6` `2.1.7` `2.1.8` `2.1.9`
`2.2` to before 2.2.9	`2.2.9`Advisories →
Also listed as affected (9) `2.2.0` `2.2.1` `2.2.2` `2.2.3` `2.2.4` `2.2.5` `2.2.6` `2.2.7` `2.2.8`
`2.3` to before 2.3.2	`2.3.2`Advisories →
Also listed as affected (2) `2.3.0` `2.3.1`

magento/product-community-edition Packagist

All magento/product-community-edition advisories →

Affected	Fixed in
`2.1` to before 2.1.18	`2.1.18`Advisories →
`2.2` to before 2.2.9	`2.2.9`Advisories →
`2.3` to before 2.3.2	`2.3.2`Advisories →

Description

A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with privileges to manipulate layouts can insert a malicious payload into the layout.

GHSA-6qh6-v99h-vh4c

Affected versions

magento/community-edition Packagist

magento/product-community-edition Packagist

Description

References