CVE-2019-8137: High severity centos libgcc vulnerability
A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with privileges to manipulate CMS section of the website can trigger remote code execution via custom layout update.
Other sources
PRODSECBUG-2414: Remote code execution through custom layout update of the content management functionality
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2019-8137?
CVE-2019-8137 is classified as a remote code execution vulnerability that can potentially allow an attacker to execute arbitrary code on affected systems.
How do I fix CVE-2019-8137?
To fix CVE-2019-8137, upgrade Magento to version 2.2.10 or 2.3.2-p1 or later versions.
Who is affected by CVE-2019-8137?
CVE-2019-8137 affects Magento versions 2.2 prior to 2.2.10 and versions 2.3 prior to 2.3.3 or 2.3.2-p1.
What are the implications of CVE-2019-8137?
The implications of CVE-2019-8137 include the potential for unauthorized access and control over the Magento eCommerce platform.
Can CVE-2019-8137 be exploited remotely?
Yes, CVE-2019-8137 can be exploited remotely by authenticated users with specific privileges.