magento/magento2 · Security
Magento 2 Community Edition Path Traversal Vulnerability
- GHSA ID
- GHSA-hqhf-8jgc-h5hx
- CVE ID
- CVE-2019-7859
- Severity
- high
- Published
- Updated
- CVSS
- 7.5 · CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- CVSS v3
- 7.5 · CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Description
A path traversal vulnerability in the WYSIWYG editor for Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 could result in unauthorized access to uploaded images due to insufficient access control.
CWEs
- CWE-22 · Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
References
- https://nvd.nist.gov/vuln/detail/CVE-2019-7859 ↗
- https://web.archive.org/web/20220127030535/https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-24 ↗
- https://github.com/FriendsOfPHP/security-advisories/blob/master/magento/product-community-edition/CVE-2019-7859.yaml ↗
- https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23 ↗
- https://github.com/advisories/GHSA-hqhf-8jgc-h5hx ↗