Description

A server-side request forgery (SSRF) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with admin privileges to modify store configurations can manipulate the connector api endpoint to enable remote code execution.

Remediation

References

CVE-2019-8156

Related Vulnerabilities

WordPress Plugin User Profile Builder-Beautiful User Registration Forms, User Profiles & User Role Editor Security Bypass (3.4.8)

WordPress Plugin Lockdown WP Admin Unspecified Vulnerability (1.1.2)

WordPress Plugin Login No Captcha reCAPTCHA Security Bypass (1.6.11)

WordPress Plugin MicroCopy SQL Injection (1.1.0)

Oracle HTTP Server Loop with Unreachable Exit Condition ('Infinite Loop') Vulnerability (CVE-2021-4182)

Severity

High

Classification

CVE-2019-8156 CWE-918 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities