Description

A server-side request forgery (SSRF) vulnerability exists in Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can be exploited by an authenticated user with access to the admin panel to manipulate system configuration and execute arbitrary code.

Remediation

References

CVE-2019-7911

Related Vulnerabilities

LimeSurvey CVE-2019-16176 Vulnerability (CVE-2019-16176)

WordPress Plugin Paid Memberships Pro-Restrict Member Access to Content, Courses, Communities-Free or Paid Subscriptions Open Redirect (2.0.5)

MySQL CVE-2022-21339 Vulnerability (CVE-2022-21339)

Jboss EAP Permissions, Privileges, and Access Controls Vulnerability (CVE-2012-1167)

MediaWiki Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2014-3454)

Severity

High

Classification

CVE-2019-7911 CWE-918 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities