Description

A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with admin privileges to layouts can execute arbitrary code through a crafted XML layout update.

Remediation

References

CVE-2019-7895

Related Vulnerabilities

Play Framework Improper Restriction of XML External Entity Reference Vulnerability (CVE-2014-3630)

Oracle Application Server Other Vulnerability (CVE-2002-0560)

WordPress Plugin Keyring Cross-Site Scripting (1.5)

Claroline Other Vulnerability (CVE-2006-1594)

Joomla CVE-2021-23127 Vulnerability (CVE-2021-23127)

Severity

High

Classification

CVE-2019-7895 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities