CVE-2019-8151: SSRF

Q: What is the severity of CVE-2019-8151?

CVE-2019-8151 has a high severity rating due to its potential for remote code execution.

Q: How do I fix CVE-2019-8151?

To fix CVE-2019-8151, update your Magento version to 2.2.10 or 2.3.3/2.3.2-p1 or higher.

Q: Who is affected by CVE-2019-8151?

CVE-2019-8151 affects Magento 2.2 versions prior to 2.2.10 and Magento 2.3 versions prior to 2.3.3.

Q: What impact does CVE-2019-8151 have on my Magento site?

CVE-2019-8151 allows authenticated users with admin privileges to execute arbitrary code, potentially compromising the site.

Q: What types of Magento installations are vulnerable to CVE-2019-8151?

Both Magento Open Source and Magento Commerce installations are vulnerable to CVE-2019-8151 if running affected versions.

Published Oct 8, 2019

Updated

A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with admin privileges to manipulate shippment settings can execute arbitrary code through server-side request forgery due to unsafe handling of a carrier gateway.

Other sources

PRODSECBUG-2367: Remote code execution due to unsafe handling of a carrier gateway

Affected Software

9 affected componentsFixes available

composer/magento/product-community-edition>=2.2, <2.2.10, >=2.3, <2.3.2-p2

composer/magento/community-edition>=2.3.0<2.3.2-p2

2.3.2-p2

composer/magento/community-edition>=2.2.0<2.2.10

2.2.10

Magento Magento>=2.2.0<2.2.10

Magento Magento>=2.3.0<2.3.2

Magento Magento=2.3.2

Remediation

Patch Available

https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update

Event History

Oct 8, 2019

Advisory Published

12:00 AM

Nov 5, 2019

CVE Published

via MITRE·11:37 PM

Data Sourced

via MITRE·11:37 PM

DescriptionWeakness

Frequently Asked Questions

What is the severity of CVE-2019-8151?