Vulnerability advisory

GHSA-w3r8-fxv5-58pp

Magento 2 Community Edition RCE Vulnerability via SSRF

Published May 24, 2022Updated Feb 16, 2024OSV record ↗

Also known as CVE-2019-7892

Severity

CVSS 3.xCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Affected versions

magento/community-edition Packagist

All magento/community-edition advisories →

Affected	Fixed in
`2.1` to before 2.1.18	`2.1.18`Advisories →
Also listed as affected (21) `2.1.0` `2.1.0-rc1` `2.1.0-rc2` `2.1.0-rc3` `2.1.1` `2.1.10` `2.1.11` `2.1.12` `2.1.13` `2.1.14` `2.1.15` `2.1.16` `2.1.17` `2.1.2` `2.1.3` `2.1.4` `2.1.5` `2.1.6` `2.1.7` `2.1.8` `2.1.9`
`2.2` to before 2.2.9	`2.2.9`Advisories →
Also listed as affected (9) `2.2.0` `2.2.1` `2.2.2` `2.2.3` `2.2.4` `2.2.5` `2.2.6` `2.2.7` `2.2.8`
`2.3` to before 2.3.2	`2.3.2`Advisories →
Also listed as affected (2) `2.3.0` `2.3.1`

Description

A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with administrator privileges to access shipment settings can execute arbitrary code via server-side request forgery.

GHSA-w3r8-fxv5-58pp

Affected versions

magento/community-edition Packagist

Description

References