CVE-2019-7925: Path Traversal
First published: Tue Jun 25 2019(Updated: )
An insecure direct object reference (IDOR) vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can be exploited by an administrator with limited privileges to delete the downloadable products folder.
Credit: psirt@adobe.com psirt@adobe.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| composer/magento/product-community-edition | >=2.1<2.1.18>=2.2<2.2.9>=2.3<2.3.2 | |
| composer/magento/community-edition | >=2.3<2.3.2 | 2.3.2 |
| composer/magento/community-edition | >=2.2<2.2.9 | 2.2.9 |
| composer/magento/community-edition | >=2.1<2.1.18 | 2.1.18 |
| CentOS Libgcc | >=2.1.0<2.1.18 | |
| CentOS Libgcc | >=2.2.0<2.2.9 | |
| CentOS Libgcc | >=2.3.0<2.3.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23
- https://nvd.nist.gov/vuln/detail/CVE-2019-7925
- https://github.com/FriendsOfPHP/security-advisories/blob/master/magento/product-community-edition/CVE-2019-7925.yaml
- https://github.com/advisories/GHSA-7g5j-q8qj-8984 (Advisory)
Frequently Asked Questions
What is the severity of CVE-2019-7925?
CVE-2019-7925 is classified as a high severity vulnerability due to the potential for unauthorized deletion of important product data.
How do I fix CVE-2019-7925?
To fix CVE-2019-7925, upgrade Magento to version 2.3.2, 2.2.9, or 2.1.18 or later.
What types of products are affected by CVE-2019-7925?
CVE-2019-7925 affects downloadable products in Magento versions prior to the fixed releases.
Who can exploit CVE-2019-7925?
CVE-2019-7925 can be exploited by administrators with limited privileges.
What does CVE-2019-7925 allow an attacker to do?
CVE-2019-7925 allows an attacker to delete the downloadable products folder, potentially impacting product availability.
- collector/friends-of-php
- agent/type
- agent/first-publish-date
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-7g5j-q8qj-8984
- alias/CVE-2019-7925
- agent/software-canonical-lookup
- agent/weakness
- agent/severity
- agent/references
- agent/description
- agent/author
- collector/github-advisory
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/event
- agent/trending
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-cve
- source/NVD
- agent/software-canonical-lookup-request
- collector/nvd-index
- package-manager/composer
- vendor/magento
- canonical/centos libgcc
- version/centos libgcc/2.1.0
- version/centos libgcc/2.2.0
- version/centos libgcc/2.3.0