CVE-2019-7903: Code Injection
Published Jun 25, 2019
·Updated
A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with admin privileges to email templates can execute arbitrary code by previewing a malicious template.
Other sources
PRODSECBUG-2306: Remote code execution through crafted email templates
Affected Software
7 affected componentsFixes available
composer/magento/product-community-edition>=2.1, <2.1.18, >=2.2, <2.2.9, >=2.3, <2.3.2
composer/magento/community-edition>=2.3.0<2.3.2
2.3.2
composer/magento/community-edition>=2.2.0<2.2.9
2.2.9
composer/magento/community-edition>=2.1.0<2.1.18
2.1.18
Magento Magento>=2.1.0<2.1.18
Magento Magento>=2.2.0<2.2.9
Magento Magento>=2.3.0<2.3.2
Event History
Jun 25, 2019
Advisory Published
12:00 AM
Aug 2, 2019
CVE Published
via MITRE·09:25 PM
Data Sourced
via MITRE·09:25 PM
DescriptionWeakness
Frequently Asked Questions
1
What is the severity of CVE-2019-7903?
CVE-2019-7903 has a high severity rating due to its potential for remote code execution.
2
How do I fix CVE-2019-7903?
To fix CVE-2019-7903, update Magento to version 2.1.18, 2.2.9, or 2.3.2 or later.
3
What affected versions are impacted by CVE-2019-7903?
CVE-2019-7903 affects Magento 2.1 prior to 2.1.18, 2.2 prior to 2.2.9, and 2.3 prior to 2.3.2.
4
Who can exploit CVE-2019-7903?
An authenticated user with admin privileges to email templates can exploit CVE-2019-7903.
5
What type of vulnerability is CVE-2019-7903?
CVE-2019-7903 is a remote code execution vulnerability.