⌘ + K

GHSA-969v-mwp3-4mr3

Dashboard / Vulnerabilities / GHSA-969v-mwp3-4mr3

GHSA-969v-mwp3-4mr3

Published: 24 May 2022Last Modified: 16 Feb 2024

Aliases:

CVE-2019-7932

Summary: Magento 2 Community Edition RCE Vulnerability

Details: A remote code execution vulnerability exists in Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with admin privileges to create sitemaps can execute arbitrary PHP code by creating a malicious sitemap file.

References: https://nvd.nist.gov/vuln/detail/CVE-2019-7932, https://github.com/FriendsOfPHP/security-advisories/blob/master/magento/magento1ce/CVE-2019-7932.yaml, https://github.com/FriendsOfPHP/security-advisories/blob/master/magento/magento1ee/CVE-2019-7932.yaml, https://github.com/FriendsOfPHP/security-advisories/blob/master/magento/product-community-edition/CVE-2019-7932.yaml, https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13, https://web.archive.org/web/20211206084839/https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13

Affected packages

Package

Name: magento/community-edition

Purl: pkg:composer/magento/community-edition

Affected ranges

Type: ECOSYSTEM

Events:

Introduced- 2.1

Fixed -2.1.18

Affected versions

2.1.0

2.1.0-rc1

2.1.0-rc2

2.1.0-rc3

2.1.1

2.1.10

2.1.11

2.1.12

2.1.13

2.1.14

2.1.15

2.1.16

2.1.17

2.1.2

2.1.3

2.1.4

2.1.5

2.1.6

2.1.7

2.1.8

2.1.9

Common Vulnerability Scoring System

Attack Vector

Network

Adjacent

Local

Physical

Privileges Required

None

Low

High

User Interaction

None

Required

Scope

Unchanged

Changed

Confidentiality

None

Low

High

Integrity

None

Low

High

Availability

None

Low

High