CVE-2019-8230: Code Injection
In Magento Open Source prior to 1.9.4.3, and Magento Commerce prior to 1.14.4.3, an authenticated user with administrative privileges to edit configuration settings can execute arbitrary code through a crafted support/output path.
Other sources
In Magentoprior to 1.9.4.3, and Magento prior to 1.14.4.3, an authenticated user with administrative privileges to edit configuration settings can execute arbitrary code through a crafted support/output path.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-8230?
CVE-2019-8230 has been classified as a critical vulnerability due to the potential for arbitrary code execution by authenticated users with administrative privileges.
How do I fix CVE-2019-8230?
To fix CVE-2019-8230, upgrade your Magento Open Source to version 1.9.4.3 or Magento Commerce to version 1.14.4.3 or later.
What versions of Magento are affected by CVE-2019-8230?
CVE-2019-8230 affects Magento Open Source versions prior to 1.9.4.3 and Magento Commerce versions prior to 1.14.4.3.
What are the implications of CVE-2019-8230?
An attacker exploiting CVE-2019-8230 could execute arbitrary code on the server, potentially leading to further compromise of the system.
Who can exploit CVE-2019-8230?
An authenticated user with administrative privileges can exploit CVE-2019-8230 to execute arbitrary code through a crafted support/output path.