Description

A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with privileges to manipulate layouts can insert a malicious payload into the layout.

Remediation

References

CVE-2019-7876

Related Vulnerabilities

WordPress Plugin Post SMTP-WP SMTP with Email Logs & Mobile App for Failure Alerts-Any SMTP Plus Gmail SMTP, Office 365, Brevo, Mailgun, Amazon SES, Postmark Cross-Site Scripting (2.1.3)

IBM RTC Other Vulnerability (CVE-2015-0112)

Oracle JRE CVE-2014-2421 Vulnerability (CVE-2014-2421)

MySQL CVE-2019-2686 Vulnerability (CVE-2019-2686)

WordPress Plugin Patreon WordPress PHP Object Injection (1.2.1)

Severity

High

Classification

CVE-2019-7876 CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities