p PatchFirst

CVE-2019-7139

CVE-2019-7139

This page contains facts from public vulnerability sources. Check the original advisory before updating.

An unauthenticated user can execute SQL statements that allow arbitrary read access to the underlying database, which causes sensitive data leakage. This issue is fixed in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2.

CVSS 9.8 · Critical · EPSS 22.2% · Public exploit · Fix available

Published
Updated

Stack: php

Affected products and versions

  • magento open source

    Versions
    • prior to 1.9.4.1: Affected

    No fix published

  • magento commerce

    Versions
    • prior to 1.14.4.1: Affected

    No fix published

  • magento

    Versions
    • prior to 2.1.17: Affected
    • prior to 2.2.8: Affected
    • prior to 2.3.1: Affected

    No fix published

  • magento/community-edition Packagist

    Versions
    • 2.1.0
    • 2.1.1
    • 2.1.10
    • 2.1.11
    • 2.1.12
    • 2.1.13
    • 2.1.14
    • 2.1.15
    • 2.1.16
    • 2.1.17
    • 2.1.2
    • 2.1.3
    • 2.1.4
    • 2.1.5
    • 2.1.6
    • 2.1.7
    • 2.1.8
    • 2.1.9
    Affected ranges
    • ECOSYSTEM: ≥ 2.1.0, < 2.1.18

    Update to 2.1.18

  • magento/community-edition Packagist

    Versions
    • 2.2.0
    • 2.2.1
    • 2.2.2
    • 2.2.3
    • 2.2.4
    • 2.2.5
    • 2.2.6
    • 2.2.7
    • 2.2.8
    Affected ranges
    • ECOSYSTEM: ≥ 2.2.0, < 2.2.9

    Update to 2.2.9

  • magento/community-edition Packagist

    Versions
    • 2.3.0
    • 2.3.1
    Affected ranges
    • ECOSYSTEM: ≥ 2.3.0, < 2.3.2

    Update to 2.3.2

Original sources

Check your server →