CVE-2019-7852
CVE-2019-7852
This page contains facts from public vulnerability sources. Check the original advisory before updating.
A path disclosure vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. Requests for a specific file path could result in a redirect to the URL of the Magento admin panel, disclosing its location to potentially unauthorized parties.
CVSS 5.3 · Medium · EPSS 0.9% · Fix available
- Published
- Updated
Stack: php
Affected products and versions
magento 2
- Versions
- Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2: Affected
No fix published
magento/community-edition Packagist
- Versions
- 2.1.0
- 2.1.1
- 2.1.10
- 2.1.11
- 2.1.12
- 2.1.13
- 2.1.14
- 2.1.15
- 2.1.16
- 2.1.17
- 2.1.2
- 2.1.3
- 2.1.4
- 2.1.5
- 2.1.6
- 2.1.7
- 2.1.8
- 2.1.9
- Affected ranges
- ECOSYSTEM: ≥ 2.1.0, < 2.1.18
Update to 2.1.18
magento/community-edition Packagist
- Versions
- 2.2.0
- 2.2.1
- 2.2.2
- 2.2.3
- 2.2.4
- 2.2.5
- 2.2.6
- 2.2.7
- 2.2.8
- Affected ranges
- ECOSYSTEM: ≥ 2.2.0, < 2.2.9
Update to 2.2.9
magento/community-edition Packagist
- Versions
- 2.3.0
- 2.3.1
- Affected ranges
- ECOSYSTEM: ≥ 2.3.0, < 2.3.2
Update to 2.3.2