CVE-2019-8150: High severity centos libgcc vulnerability
A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with privileges to manipulate layouts and images can insert a malicious payload into the page layout.
Other sources
PRODSECBUG-2376: Remote code execution through crafted page layout and image data
Affected Software
Remediation
Event History
Frequently Asked Questions
What versions are affected by CVE-2019-8150?
CVE-2019-8150 affects Magento versions 2.2 prior to 2.2.10 and 2.3 prior to 2.3.3 or 2.3.2-p1.
What is the severity of CVE-2019-8150?
CVE-2019-8150 is classified as a remote code execution vulnerability.
How do I fix CVE-2019-8150?
To fix CVE-2019-8150, upgrade your Magento to version 2.2.10 or 2.3.3 and above.
Can unauthorized users exploit CVE-2019-8150?
No, CVE-2019-8150 can only be exploited by authenticated users with privileges to manipulate layouts and images.
What type of vulnerability is CVE-2019-8150?
CVE-2019-8150 is a remote code execution vulnerability that allows attackers to insert malicious payloads into the page layout.