CVE-2019-7139: XSS
An unauthenticated user can execute SQL statements that allow arbitrary read access to the underlying database, which causes sensitive data leakage. This issue is fixed in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2.
Other sources
PRODSECBUG-2198: SQL Injection due to a flaw in MySQL adapter
SUPEE-11086 - RCE, XSS, CSRF and other vulnerabilities
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-7139?
CVE-2019-7139 has a critical severity rating due to its potential for sensitive data leakage.
How do I fix CVE-2019-7139?
To fix CVE-2019-7139, upgrade to Magento versions 2.1.18, 2.2.9, or 2.3.2 or later.
Which versions of Magento are affected by CVE-2019-7139?
CVE-2019-7139 affects Magento versions prior to 2.1.18, 2.2.9, and 2.3.2.
Is CVE-2019-7139 an authenticated or unauthenticated vulnerability?
CVE-2019-7139 is an unauthenticated vulnerability, allowing attackers to execute SQL statements.
What type of vulnerability is CVE-2019-7139 classified as?
CVE-2019-7139 is classified as an SQL injection vulnerability.