CVE-2019-8154: High severity centos libgcc vulnerability
A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with privileges to modify product catalogs can trigger PHP file inclusion through a crafted XML file that specifies product design update.
Other sources
PRODSECBUG-2332: Remote code execution through arbitrary file inclusion
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2019-8154?
CVE-2019-8154 has a high severity rating due to its potential for remote code execution.
How do I fix CVE-2019-8154?
To mitigate CVE-2019-8154, upgrade your Magento installation to version 2.2.10 or 2.3.3 and above.
Which versions are affected by CVE-2019-8154?
CVE-2019-8154 affects Magento 2.2 versions prior to 2.2.10 and Magento 2.3 versions prior to 2.3.3 or 2.3.2-p1.
Can an unauthenticated user exploit CVE-2019-8154?
No, exploitation of CVE-2019-8154 requires an authenticated user with the ability to modify product catalogs.
What type of attack does CVE-2019-8154 facilitate?
CVE-2019-8154 facilitates a remote code execution attack through PHP file inclusion from a crafted XML file.