CVE-2019-7871: Code Injection
First published: Tue Jun 25 2019(Updated: )
A security bypass exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 that could be abused to execute arbitrary PHP code. An authenticated user can bypass security protections that prevent arbitrary PHP script upload via form data injection.
Credit: psirt@adobe.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| composer/magento/product-community-edition | >=2.1<2.1.18>=2.2<2.2.9>=2.3<2.3.2 | |
| composer/magento/community-edition | >=2.3.0<2.3.2 | 2.3.2 |
| composer/magento/community-edition | >=2.2.0<2.2.9 | 2.2.9 |
| composer/magento/community-edition | >=2.1.0<2.1.18 | 2.1.18 |
| CentOS Libgcc | >=2.1.0<2.1.18 | |
| CentOS Libgcc | >=2.2.0<2.2.9 | |
| CentOS Libgcc | >=2.3.0<2.3.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13
- https://nvd.nist.gov/vuln/detail/CVE-2019-7871
- https://web.archive.org/web/20211206084839/https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13
- https://github.com/advisories/GHSA-v527-6h5r-cfg8 (Advisory)
- https://github.com/FriendsOfPHP/security-advisories/blob/master/magento/product-community-edition/CVE-2019-7871.yaml
Frequently Asked Questions
What is the severity of CVE-2019-7871?
CVE-2019-7871 is classified as a high severity vulnerability due to its potential to allow authenticated users to execute arbitrary PHP code.
How do I fix CVE-2019-7871?
To resolve CVE-2019-7871, upgrade Magento to version 2.1.18, 2.2.9, or 2.3.2, depending on your current version.
Who is affected by CVE-2019-7871?
CVE-2019-7871 affects Magento versions 2.1 to 2.1.17, 2.2 to 2.2.8, and 2.3 to 2.3.1.
What type of attack is enabled by CVE-2019-7871?
CVE-2019-7871 allows an authenticated attacker to bypass security measures and upload arbitrary PHP scripts via form data injection.
What software components are vulnerable in CVE-2019-7871?
The vulnerability CVE-2019-7871 impacts Magento systems running affected versions of the product-community-edition.
- collector/friends-of-php
- agent/type
- agent/first-publish-date
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-v527-6h5r-cfg8
- alias/CVE-2019-7871
- agent/software-canonical-lookup
- agent/references
- agent/severity
- agent/weakness
- agent/description
- collector/github-advisory
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/event
- agent/trending
- agent/source
- agent/author
- agent/softwarecombine
- agent/tags
- collector/nvd-cve
- source/NVD
- agent/software-canonical-lookup-request
- collector/nvd-index
- package-manager/composer
- vendor/magento
- canonical/centos libgcc
- version/centos libgcc/2.1.0
- version/centos libgcc/2.2.0
- version/centos libgcc/2.3.0