CVE-2019-8135: Remote code execution via vulnerable Symphony dependecy injection

Q: What is the severity of CVE-2019-8135?

CVE-2019-8135 is rated as a critical vulnerability due to its potential for remote code execution.

Q: How do I fix CVE-2019-8135?

To fix CVE-2019-8135, users should upgrade to Magento version 2.2.10 or higher and version 2.3.3 or higher.

Q: Which versions of Magento are affected by CVE-2019-8135?

CVE-2019-8135 affects Magento 2.2 versions prior to 2.2.10 and Magento 2.3 versions prior to 2.3.3 or 2.3.2-p1.

Q: What type of vulnerability is CVE-2019-8135?

CVE-2019-8135 is a remote code execution vulnerability due to dependency injection issues in the Symphony framework.

Q: What are the consequences of CVE-2019-8135 being exploited?

If exploited, CVE-2019-8135 could allow attackers to execute arbitrary code on the server running affected Magento versions.

Published Oct 8, 2019

Updated

A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. Dependency injection through Symphony framework allows service identifiers to be derived from user controlled data, which can lead to remote code execution.

Other sources

PRODSECBUG-2417: Remote code execution via vulnerable Symphony dependecy injection

Affected Software

13 affected componentsFixes available

composer/magento/product-community-edition>=2.2, <2.2.10, >=2.3, <2.3.2-p2

composer/magento/community-edition>=2.3<2.3.2-p2

2.3.2-p2

composer/magento/community-edition>=2.2<2.2.10

2.2.10

Magento Magento>=2.2.0<2.2.10

Magento Magento>=2.3.0<2.3.2

Magento Magento=2.3.2

composer/magento/community-edition>=2.3, <2.3.2-p2

2.3.2-p2

composer/magento/community-edition>=2.2, <2.2.10

2.2.10

composer/magento/product-community-edition>=2.2, <2.2.10

2.2.10

composer/magento/product-community-edition>=2.3, <2.3.2-p2

2.3.2-p2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade composer/magento/community-edition to a version that resolves this vulnerability.
Fixed in 2.3.2-p2
Upgrade
Upgrade composer/magento/community-edition to a version that resolves this vulnerability.
Fixed in 2.2.10
Upgrade
Upgrade composer/magento/product-community-edition to a version that resolves this vulnerability.
Fixed in 2.2.10
Upgrade
Upgrade composer/magento/product-community-edition to a version that resolves this vulnerability.
Fixed in 2.3.2-p2
Upgrade
Upgrade Magento to a version that resolves this vulnerability.
Fixed in 2.2.10
Upgrade
Upgrade Magento to a version that resolves this vulnerability.
Fixed in 2.3.3
Upgrade
Upgrade Magento to a version that resolves this vulnerability.
Fixed in 2.3.2-p1
Upgrade
Upgrade Magento to a version that resolves this vulnerability.
Fixed in 2.3.2-p2

Event History

Oct 8, 2019

Advisory Published

12:00 AM

Data Sourced

via Packagist·12:00 AM

DescriptionSeverityAffected Software

Nov 5, 2019

CVE Published

via MITRE·11:17 PM

Data Sourced

via MITRE·11:17 PM

DescriptionWeakness

Nov 6, 2019

Data Sourced

via NVD·12:15 AM

RemedyDescriptionSeverityWeaknessAffected Software

Nov 12, 2019

Advisory Published

via GitHub·10:59 PM

Data Sourced

via GitHub·10:59 PM

DescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2019-8135?

CVE-2019-8135 is rated as a critical vulnerability due to its potential for remote code execution.

How do I fix CVE-2019-8135?

To fix CVE-2019-8135, users should upgrade to Magento version 2.2.10 or higher and version 2.3.3 or higher.

Which versions of Magento are affected by CVE-2019-8135?

CVE-2019-8135 affects Magento 2.2 versions prior to 2.2.10 and Magento 2.3 versions prior to 2.3.3 or 2.3.2-p1.

What type of vulnerability is CVE-2019-8135?

CVE-2019-8135 is a remote code execution vulnerability due to dependency injection issues in the Symphony framework.

What are the consequences of CVE-2019-8135 being exploited?

If exploited, CVE-2019-8135 could allow attackers to execute arbitrary code on the server running affected Magento versions.

CVE-2019-8135: Remote code execution via vulnerable Symphony dependecy injection

Other sources

Affected Software

Remediation

Event History

Frequently Asked Questions

What is the severity of CVE-2019-8135?

How do I fix CVE-2019-8135?

Which versions of Magento are affected by CVE-2019-8135?

What type of vulnerability is CVE-2019-8135?

What are the consequences of CVE-2019-8135 being exploited?

Company

Resources

Contact