CVE-2019-8232
CVE-2019-8232
This page contains facts from public vulnerability sources. Check the original advisory before updating.
In Magento prior to 1.9.4.3, Magento prior to 1.14.4.3, Magento 2.2 prior to 2.2.10, and Magento 2.3 prior to 2.3.3 or 2.3.2-p1, an authenticated user with administrative privileges for the import feature can execute arbitrary code through a race condition that allows webserver configuration file modification.
CVSS 6.6 · Medium · EPSS 0.9% · Fix available
- Published
- Updated
Stack: php
Affected products and versions
magento 1 & 2
- Versions
- Magento Open Source prior to 1.9.4.3, and Magento Commerce prior to 1.14.4.3, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1: Affected
No fix published
magento/community-edition Packagist
- Versions
- 2.2.0
- 2.2.1
- 2.2.2
- 2.2.3
- 2.2.4
- 2.2.5
- 2.2.6
- 2.2.7
- 2.2.8
- 2.2.9
- Affected ranges
- ECOSYSTEM: ≥ 2.2.0, < 2.2.10
Update to 2.2.10
magento/community-edition Packagist
- Versions
- 2.3.0
- 2.3.1
- 2.3.2
- Affected ranges
- ECOSYSTEM: ≥ 2.3.0, < 2.3.2-p1
Update to 2.3.2-p1