CVE-2019-7876
CVE-2019-7876
This page contains facts from public vulnerability sources. Check the original advisory before updating.
A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with privileges to manipulate layouts can insert a malicious payload into the layout.
CVSS 8.8 · High · EPSS 2.0% · Fix available
- Published
- Updated
Stack: php
Affected products and versions
magento 2
- Versions
- Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2: Affected
No fix published
magento/community-edition Packagist
- Versions
- 2.1.0
- 2.1.0-rc1
- 2.1.0-rc2
- 2.1.0-rc3
- 2.1.1
- 2.1.10
- 2.1.11
- 2.1.12
- 2.1.13
- 2.1.14
- 2.1.15
- 2.1.16
- 2.1.17
- 2.1.2
- 2.1.3
- 2.1.4
- 2.1.5
- 2.1.6
- 2.1.7
- 2.1.8
- 2.1.9
- Affected ranges
- ECOSYSTEM: ≥ 2.1, < 2.1.18
Update to 2.1.18
magento/community-edition Packagist
- Versions
- 2.2.0
- 2.2.1
- 2.2.2
- 2.2.3
- 2.2.4
- 2.2.5
- 2.2.6
- 2.2.7
- 2.2.8
- Affected ranges
- ECOSYSTEM: ≥ 2.2, < 2.2.9
Update to 2.2.9
magento/community-edition Packagist
- Versions
- 2.3.0
- 2.3.1
- Affected ranges
- ECOSYSTEM: ≥ 2.3, < 2.3.2
Update to 2.3.2
magento/product-community-edition Packagist
- Affected ranges
- ECOSYSTEM: ≥ 2.1, < 2.1.18
Update to 2.1.18
magento/product-community-edition Packagist
- Affected ranges
- ECOSYSTEM: ≥ 2.2, < 2.2.9
Update to 2.2.9
magento/product-community-edition Packagist
- Affected ranges
- ECOSYSTEM: ≥ 2.3, < 2.3.2
Update to 2.3.2