Description

A SQL injection vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. A user with store manipulation privileges can execute arbitrary SQL queries by getting access to the database connection through group instance in email templates.

Remediation

References

CVE-2019-8130

Related Vulnerabilities

Drupal Core 6.x Multiple Security Bypass Vulnerabilities (6.0 - 6.4)

WordPress Plugin Photo Gallery by 10Web-Mobile-Friendly Image Gallery Multiple Cross-Site Scripting Vulnerabilities (1.1.30)

WordPress Plugin Zedna eBook download Directory Traversal (1.1)

WordPress Plugin Easy PayPal Events Unspecified Vulnerability (1.1.6)

WordPress Plugin WP Post Rating Security Bypass (2.4.6)

Severity

High

Classification

CVE-2019-8130 CWE-138 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities