magento/magento2 · Security
Magento Unrestricted file upload vulnerability
- GHSA ID
- GHSA-7pr3-34rg-g53m
- CVE ID
- CVE-2019-8140
- Severity
- medium
- Published
- Updated
- CVSS
- 4.9 · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
- CVSS v3
- 4.9 · CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
Description
An unrestricted file upload vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated admin user can manipulate the Synchronization feature in the Media File Storage of the database to transform uploaded JPEG file into a PHP file.
CWEs
- CWE-434 · Unrestricted Upload of File with Dangerous Type