CVE-2019-7896
Last modified
CVE-2019-7896 is a vulnerability of currently unknown severity. A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with administrator privileges to layouts can execute arbitrary code through a combination of product import, crafted csv file and XML layout update.. EPSS estimates a 1.92% chance of exploitation in the next 30 days.
Description
A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with administrator privileges to layouts can execute arbitrary code through a combination of product import, crafted csv file and XML layout update.
Metrics
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Magento | Magento | >= 2.1.0, < 2.1.18 |
| Magento | Magento | >= 2.2.0, < 2.2.9 |
| Magento | Magento | >= 2.3.0, < 2.3.2 |
References
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2019-7896?
How severe is CVE-2019-7896?
How do I fix CVE-2019-7896?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2019
- CVE-2019-7889An injection vulnerability exists in Magento Open Source pri…
- CVE-2019-7890An Insecure Direct Object Reference (IDOR) vulnerability exi…
- CVE-2019-7891Rejected reason: Reserved ID never published and not linked …
- CVE-2019-7892A remote code execution vulnerability exists in Magento 2.1 …
- CVE-2019-7893Rejected reason: Reserved ID never published and not linked …
- CVE-2019-7895A remote code execution vulnerability exists in Magento 2.1 …
- CVE-2019-7897A stored cross-site scripting vulnerability exists in the ad…
- CVE-2019-7898Samples of disabled downloadable products are accessible in …
- CVE-2019-7899Names of disabled downloadable products could be disclosed d…
- CVE-2019-7903A remote code execution vulnerability exists in Magento 2.1 …
- CVE-2019-7904Insufficient enforcement of user access controls in Magento …
- CVE-2019-7907Rejected reason: Reserved 2019 Magento 1 ID with no publishe…
Are you affected by CVE-2019-7896?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST