CVE-2019-8111: High severity centos libgcc vulnerability
A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can leverage plugin functionality related to email templates to manipulate the interceptor class in a way that allows an attacker to execute arbitrary code.
Other sources
PRODSECBUG-2469: Remote Code Execution in email templates
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2019-8111?
CVE-2019-8111 has been assessed with a critical severity due to its potential for remote code execution.
How do I fix CVE-2019-8111?
To remediate CVE-2019-8111, upgrade to Magento 2.2.10 or 2.3.3 or later versions.
What versions of Magento are affected by CVE-2019-8111?
CVE-2019-8111 affects Magento versions 2.2.0 to 2.2.9 and 2.3.0 to 2.3.2.
Who can exploit CVE-2019-8111?
CVE-2019-8111 can be exploited by authenticated users who have access to the email templates plugin.
What is the impact of CVE-2019-8111?
The impact of CVE-2019-8111 allows an attacker to execute arbitrary code on the Magento server.