CVE-2019-8127: SQL Injection
A SQL injection vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with privileges to an account with Newsletter Template editing permission could exfiltrate the Admin login data, and reset their password, effectively performing a privilege escalation.
Other sources
PRODSECBUG-2434: SQL injection in 'Catalog Products List' widget leading to privilege escalation
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-8127?
CVE-2019-8127 is classified as a critical vulnerability due to its potential impact on sensitive data and account access.
How do I fix CVE-2019-8127?
To fix CVE-2019-8127, update to Magento version 2.2.10 or later for 2.2.x versions, or to version 2.3.3 or later for 2.3.x versions.
What type of vulnerability is CVE-2019-8127?
CVE-2019-8127 is a SQL injection vulnerability that allows an authenticated user to exfiltrate sensitive information.
Who is affected by CVE-2019-8127?
CVE-2019-8127 affects Magento 2.2 versions prior to 2.2.10 and 2.3 versions prior to 2.3.3 or 2.3.2-p1.
What can an attacker do with CVE-2019-8127?
An attacker with the right permissions can exploit CVE-2019-8127 to exfiltrate Admin login data and reset passwords.