CVE-2019-8230: Magento Remote code execution through support/output path modification
In Magento Open Source prior to 1.9.4.3, and Magento Commerce prior to 1.14.4.3, an authenticated user with administrative privileges to edit configuration settings can execute arbitrary code through a crafted support/output path.
Other sources
In Magentoprior to 1.9.4.3, and Magento prior to 1.14.4.3, an authenticated user with administrative privileges to edit configuration settings can execute arbitrary code through a crafted support/output path.
— MITRE
Magento Remote code execution through support/output path modification
— Packagist
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/magento/coreto a version that resolves this vulnerability.Fixed in 1.9.4.3 - Upgrade
Upgrade
Magento Open Sourceto a version that resolves this vulnerability.Fixed in 1.9.4.3 - Upgrade
Upgrade
Magento Commerceto a version that resolves this vulnerability.Fixed in 1.14.4.3
Event History
Frequently Asked Questions
What is the severity of CVE-2019-8230?
CVE-2019-8230 has been classified as a critical vulnerability due to the potential for arbitrary code execution by authenticated users with administrative privileges.
How do I fix CVE-2019-8230?
To fix CVE-2019-8230, upgrade your Magento Open Source to version 1.9.4.3 or Magento Commerce to version 1.14.4.3 or later.
What versions of Magento are affected by CVE-2019-8230?
CVE-2019-8230 affects Magento Open Source versions prior to 1.9.4.3 and Magento Commerce versions prior to 1.14.4.3.
What are the implications of CVE-2019-8230?
An attacker exploiting CVE-2019-8230 could execute arbitrary code on the server, potentially leading to further compromise of the system.
Who can exploit CVE-2019-8230?
An authenticated user with administrative privileges can exploit CVE-2019-8230 to execute arbitrary code through a crafted support/output path.