CVE-2019-8232
Last modified
CVE-2019-8232 is a medium-severity vulnerability rated 6.6/10 on the CVSS scale. In Magento prior to 1.9.4.3, Magento prior to 1.14.4.3, Magento 2.2 prior to 2.2.10, and Magento 2.3 prior to 2.3.3 or 2.3.2-p1, an authenticated user with administrative privileges for the import feature can execute arbitrary code through a race condition that allows webserver configuration file modification.. EPSS estimates a 0.85% chance of exploitation in the next 30 days.
Description
In Magento prior to 1.9.4.3, Magento prior to 1.14.4.3, Magento 2.2 prior to 2.2.10, and Magento 2.3 prior to 2.3.3 or 2.3.2-p1, an authenticated user with administrative privileges for the import feature can execute arbitrary code through a race condition that allows webserver configuration file modification.
Metrics
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Magento | Magento | >= 1.5.0.0, < 1.9.4.3 |
| Magento | Magento | >= 1.9.0.0, < 1.14.4.3 |
| Magento | Magento | >= 2.2.0, < 2.2.10 |
| Magento | Magento | >= 2.3.0, < 2.3.2 |
| Magento | Magento | 2.3.2 |
References
- https://magento.com/security/patches/supee-11219Vendor Advisory
- https://magento.com/security/patches/supee-11219Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2019-8232?
How severe is CVE-2019-8232?
How do I fix CVE-2019-8232?
Are you affected by CVE-2019-8232?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST