CVE-2019-8159: OS Command Injection
A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with system data manipulation privileges can execute aribitrary code through arbitrary file deletion and OS command injection.
Other sources
PRODSECBUG-2223: Remote code execution when using functionality that imports a new product
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-8159?
CVE-2019-8159 is classified as a critical remote code execution vulnerability.
How do I fix CVE-2019-8159?
To fix CVE-2019-8159, upgrade Magento to version 2.2.10 or later, or to version 2.3.3 or later.
Who is affected by CVE-2019-8159?
CVE-2019-8159 affects Magento 2.2 versions prior to 2.2.10 and Magento 2.3 versions prior to 2.3.3.
What type of vulnerability is CVE-2019-8159?
CVE-2019-8159 is a remote code execution vulnerability that allows authenticated users with system data manipulation privileges to execute arbitrary code.
Is CVE-2019-8159 a local or remote vulnerability?
CVE-2019-8159 is a remote vulnerability as it can be exploited by an authenticated user from a remote location.