CVE-2019-8126

Published: Nov 5, 2019Modified: Nov 21, 2024

4.9

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N

Exploitability: 1.2 / Impact: 3.6

Source: NVD

Description

An XML entity injection vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated admin user can craft document type definition for an XML representing XML layout. The crafted document type definition and XML layout allow processing of external entities which can lead to information disclosure.

Affected (6)

Products: Magento: Magento

Magento

1 product

Magento

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Magento Magento	From 2.2.0 to 2.2.10
Magento Magento	From 2.3.0 to 2.3.2
Magento Magento	From 2.2.0 to 2.2.10
Magento Magento	From 2.3.0 to 2.3.2
Magento Magento	Version 2.3.2
Magento Magento	Version 2.3.2

Related CWEs

CWE-611

Improper Restriction of XML External Entity Reference

The product processes an XML document that can contain XML entities with URIs that resolve to documents outside of the intended sphere of control, causing the product to embed incorrect documents into its output.

References (2)

https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update

Source: psirt@adobe.com

PatchVendor Advisory

https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update

Source: af854a3a-2127-422b-91ae-364da2661108

PatchVendor Advisory

Timeline

No history available yet.