CVE-2019-7895: Magento 2 Community Edition RCE Vulnerability
A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with admin privileges to layouts can execute arbitrary code through a crafted XML layout update.
Other sources
Magento 2 Community Edition RCE Vulnerability
— Packagist
PRODSECBUG-2296: Arbitrary code execution through design layout update
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/magento/community-editionto a version that resolves this vulnerability.Fixed in 2.3.2 - Upgrade
Upgrade
composer/magento/community-editionto a version that resolves this vulnerability.Fixed in 2.2.9 - Upgrade
Upgrade
composer/magento/community-editionto a version that resolves this vulnerability.Fixed in 2.1.18 - Upgrade
Upgrade
composer/magento/product-community-editionto a version that resolves this vulnerability.Fixed in 2.1.18 - Upgrade
Upgrade
composer/magento/product-community-editionto a version that resolves this vulnerability.Fixed in 2.2.9 - Upgrade
Upgrade
composer/magento/product-community-editionto a version that resolves this vulnerability.Fixed in 2.3.2 - Upgrade
Upgrade
Magento 2.1to a version that resolves this vulnerability.Fixed in 2.1.18 - Upgrade
Upgrade
Magento 2.2to a version that resolves this vulnerability.Fixed in 2.2.9 - Upgrade
Upgrade
Magento 2.3to a version that resolves this vulnerability.Fixed in 2.3.2
Event History
Frequently Asked Questions
What is the severity of CVE-2019-7895?
CVE-2019-7895 is classified as a remote code execution vulnerability, which is considered highly severe due to its potential to allow unauthorized code execution.
How do I fix CVE-2019-7895?
To fix CVE-2019-7895, upgrade your Magento installation to version 2.1.18, 2.2.9, or 2.3.2 or later.
Who is impacted by CVE-2019-7895?
CVE-2019-7895 affects Magento 2.1 versions prior to 2.1.18, 2.2 versions prior to 2.2.9, and 2.3 versions prior to 2.3.2.
What type of users can exploit CVE-2019-7895?
An authenticated user with admin privileges in the Magento system can exploit CVE-2019-7895 to execute arbitrary code.
What exposure does CVE-2019-7895 create?
CVE-2019-7895 creates the risk of unauthorized access and control over the server running the vulnerable Magento versions.