magento/magento2 · Security
Magento 2 Community Edition RCE Vulnerability
- GHSA ID
- GHSA-6vc8-3xf2-qrxx
- CVE ID
- CVE-2019-8232
- Severity
- medium
- Published
- Updated
- CVSS
- 6.6 · CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
- CVSS v3
- 6.6 · CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Description
In Magento prior to 1.9.4.3, Magento prior to 1.14.4.3, Magento 2.2 prior to 2.2.10, and Magento 2.3 prior to 2.3.3 or 2.3.2-p1, an authenticated user with administrative privileges for the import feature can execute arbitrary code through a race condition that allows webserver configuration file modification.
CWEs
- CWE-362 · Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')