Description

A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with privileges to manipulate CMS section of the website can trigger remote code execution via custom layout update.

Remediation

References

CVE-2019-8137

Related Vulnerabilities

Liferay Portal CVE-2022-42126 Vulnerability (CVE-2022-42126)

WordPress Plugin WordPress Gallery Cross-Site Scripting (1.0)

Drupal Files or Directories Accessible to External Parties Vulnerability (CVE-2017-6922)

WordPress Plugin Calendar Event Multi View Unspecified Vulnerability (1.3.58)

WordPress Plugin Mobile App Native (Make a mobile app-Native iPhone & Android Mobile App FREE) Arbitrary File Upload (3.0)

Severity

High

Classification

CVE-2019-8137 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities