CVE-2019-8158
CVE-2019-8158
This page contains facts from public vulnerability sources. Check the original advisory before updating.
An XPath entity injection vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An attacker can craft a GET request to page cache block rendering module that gets passed to XML data processing engine without validation. The crafted key/value GET request data allows an attacker to limited access to underlying XML data.
CVSS 9.8 · Critical · EPSS 1.3% · Fix available
- Published
- Updated
Stack: php
Affected products and versions
magento 2
- Versions
- Magento 2.2 prior to 2.2.10: Affected
- Magento 2.3 prior to 2.3.3 or 2.3.2-p1: Affected
No fix published
magento/community-edition Packagist
- Versions
- 2.2.0
- 2.2.1
- 2.2.2
- 2.2.3
- 2.2.4
- 2.2.5
- 2.2.6
- 2.2.7
- 2.2.8
- 2.2.9
- Affected ranges
- ECOSYSTEM: ≥ 2.2.0, < 2.2.10
Update to 2.2.10
magento/community-edition Packagist
- Versions
- 2.3.0
- 2.3.1
- 2.3.2
- Affected ranges
- ECOSYSTEM: ≥ 2.3.0, < 2.3.2-p2
Update to 2.3.2-p2