Description

A server-side request forgery (SSRF) vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can be exploited by authenticated user with admin privileges to manipulate shipment settings to execute arbitrary code.

Remediation

References

CVE-2019-7923

Related Vulnerabilities

Moodle Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2010-1614)

Apache Tomcat CVE-2023-44487 Vulnerability (CVE-2023-44487)

Oracle Database Server CVE-2014-6538 Vulnerability (CVE-2014-6538)

WordPress Plugin WordPress Payments-GetPaid Cross-Site Scripting (2.3.3)

WordPress Plugin Variation Swatches for WooCommerce Cross-Site Scripting (2.1.1)

Severity

High

Classification

CVE-2019-7923 CWE-918 CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities