CVE-2019-7895
First published: Tue Jun 25 2019(Updated: )
A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with admin privileges to layouts can execute arbitrary code through a crafted XML layout update.
Credit: psirt@adobe.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| composer/magento/product-community-edition | >=2.1<2.1.18>=2.2<2.2.9>=2.3<2.3.2 | |
| composer/magento/community-edition | >=2.3<2.3.2 | 2.3.2 |
| composer/magento/community-edition | >=2.2<2.2.9 | 2.2.9 |
| composer/magento/community-edition | >=2.1<2.1.18 | 2.1.18 |
| CentOS Libgcc | >=2.1.0<2.1.18 | |
| CentOS Libgcc | >=2.2.0<2.2.9 | |
| CentOS Libgcc | >=2.3.0<2.3.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13
- https://nvd.nist.gov/vuln/detail/CVE-2019-7895
- https://web.archive.org/web/20211206084839/https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13
- https://github.com/advisories/GHSA-mw5w-cf76-73m8 (Advisory)
- https://github.com/FriendsOfPHP/security-advisories/blob/master/magento/product-community-edition/CVE-2019-7895.yaml
Frequently Asked Questions
What is the severity of CVE-2019-7895?
CVE-2019-7895 is classified as a remote code execution vulnerability, which is considered highly severe due to its potential to allow unauthorized code execution.
How do I fix CVE-2019-7895?
To fix CVE-2019-7895, upgrade your Magento installation to version 2.1.18, 2.2.9, or 2.3.2 or later.
Who is impacted by CVE-2019-7895?
CVE-2019-7895 affects Magento 2.1 versions prior to 2.1.18, 2.2 versions prior to 2.2.9, and 2.3 versions prior to 2.3.2.
What type of users can exploit CVE-2019-7895?
An authenticated user with admin privileges in the Magento system can exploit CVE-2019-7895 to execute arbitrary code.
What exposure does CVE-2019-7895 create?
CVE-2019-7895 creates the risk of unauthorized access and control over the server running the vulnerable Magento versions.
- collector/friends-of-php
- agent/type
- agent/first-publish-date
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-mw5w-cf76-73m8
- alias/CVE-2019-7895
- agent/software-canonical-lookup
- agent/severity
- agent/references
- agent/description
- collector/github-advisory
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/event
- agent/trending
- agent/source
- agent/author
- agent/softwarecombine
- agent/tags
- collector/nvd-cve
- source/NVD
- agent/software-canonical-lookup-request
- collector/nvd-index
- package-manager/composer
- vendor/magento
- canonical/centos libgcc
- version/centos libgcc/2.1.0
- version/centos libgcc/2.2.0
- version/centos libgcc/2.3.0