CVE-2019-7871: Code Injection
A security bypass exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 that could be abused to execute arbitrary PHP code. An authenticated user can bypass security protections that prevent arbitrary PHP script upload via form data injection.
Other sources
PRODSECBUG-2202: Security bypass via form data injection
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-7871?
CVE-2019-7871 is classified as a high severity vulnerability due to its potential to allow authenticated users to execute arbitrary PHP code.
How do I fix CVE-2019-7871?
To resolve CVE-2019-7871, upgrade Magento to version 2.1.18, 2.2.9, or 2.3.2, depending on your current version.
Who is affected by CVE-2019-7871?
CVE-2019-7871 affects Magento versions 2.1 to 2.1.17, 2.2 to 2.2.8, and 2.3 to 2.3.1.
What type of attack is enabled by CVE-2019-7871?
CVE-2019-7871 allows an authenticated attacker to bypass security measures and upload arbitrary PHP scripts via form data injection.
What software components are vulnerable in CVE-2019-7871?
The vulnerability CVE-2019-7871 impacts Magento systems running affected versions of the product-community-edition.