CVE-2019-8127: Magento 2 Community Edition SQLi Vulnerability
A SQL injection vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with privileges to an account with Newsletter Template editing permission could exfiltrate the Admin login data, and reset their password, effectively performing a privilege escalation.
Other sources
Magento 2 Community Edition SQLi Vulnerability
— Packagist
PRODSECBUG-2434: SQL injection in 'Catalog Products List' widget leading to privilege escalation
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/magento/community-editionto a version that resolves this vulnerability.Fixed in 2.3.2-p2 - Upgrade
Upgrade
composer/magento/community-editionto a version that resolves this vulnerability.Fixed in 2.2.10 - Upgrade
Upgrade
composer/magento/product-community-editionto a version that resolves this vulnerability.Fixed in 2.2.10 - Upgrade
Upgrade
composer/magento/product-community-editionto a version that resolves this vulnerability.Fixed in 2.3.2-p2 - Upgrade
Upgrade
Magentoto a version that resolves this vulnerability.Fixed in 2.2.10 - Upgrade
Upgrade
Magentoto a version that resolves this vulnerability.Fixed in 2.3.3 - Upgrade
Upgrade
Magentoto a version that resolves this vulnerability.Fixed in 2.3.2-p1 - Upgrade
Upgrade
Magentoto a version that resolves this vulnerability.Fixed in 2.3.2-p2
Event History
Frequently Asked Questions
What is the severity of CVE-2019-8127?
CVE-2019-8127 is classified as a critical vulnerability due to its potential impact on sensitive data and account access.
How do I fix CVE-2019-8127?
To fix CVE-2019-8127, update to Magento version 2.2.10 or later for 2.2.x versions, or to version 2.3.3 or later for 2.3.x versions.
What type of vulnerability is CVE-2019-8127?
CVE-2019-8127 is a SQL injection vulnerability that allows an authenticated user to exfiltrate sensitive information.
Who is affected by CVE-2019-8127?
CVE-2019-8127 affects Magento 2.2 versions prior to 2.2.10 and 2.3 versions prior to 2.3.3 or 2.3.2-p1.
What can an attacker do with CVE-2019-8127?
An attacker with the right permissions can exploit CVE-2019-8127 to exfiltrate Admin login data and reset passwords.