CVE-2019-8130: SQL Injection
A SQL injection vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. A user with store manipulation privileges can execute arbitrary SQL queries by getting access to the database connection through group instance in email templates.
Other sources
PRODSECBUG-2424: SQL injection when accessing group data in email templates
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-8130?
CVE-2019-8130 is categorized as a high severity SQL injection vulnerability.
How do I fix CVE-2019-8130?
To fix CVE-2019-8130, upgrade to Magento 2.2.10 or later, or Magento 2.3.3 or later.
What versions of Magento are affected by CVE-2019-8130?
CVE-2019-8130 affects Magento versions 2.2 prior to 2.2.10 and 2.3 prior to 2.3.3 or 2.3.2-p1.
What type of vulnerability is CVE-2019-8130?
CVE-2019-8130 is a SQL injection vulnerability that can allow a user to execute arbitrary SQL queries.
Who can exploit CVE-2019-8130?
A user with store manipulation privileges can exploit CVE-2019-8130.