mirror of
https://github.com/netbirdio/advisory-database.git
synced 2026-05-22 18:04:22 -07:00
Publish Advisories
GHSA-4v2q-hjx3-c4vr GHSA-775w-gx3f-4j4f GHSA-8p5c-f836-m4h7
This commit is contained in:
advisory-database[bot]
@@ -1,13 +1,13 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-4v2q-hjx3-c4vr",
|
||||
"modified": "2024-01-10T19:38:39Z",
|
||||
"modified": "2024-02-12T11:52:59Z",
|
||||
"published": "2022-05-24T22:01:04Z",
|
||||
"aliases": [
|
||||
"CVE-2019-8154"
|
||||
],
|
||||
"summary": "Magento remote code execution vulnerability",
|
||||
"details": "A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with privileges to modify product catalogs can trigger PHP file inclusion through a crafted XML file that specifies product design update.",
|
||||
"details": "A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with privileges to modify product catalogs can trigger PHP file inclusion through a crafted XML file that specifies product design update.\n\nAs per [the Magento Release 2.3.3](https://web.archive.org/web/20201126132230/https://devdocs.magento.com/guides/v2.3/release-notes/release-notes-2-3-3-commerce.html#new-security-only-patch-available), if you have already implemented the pre-release version of this patch (2.3.2-p1), it is highly recommended to promptly upgrade to 2.3.2-p2.\n",
|
||||
"severity": [
|
||||
{
|
||||
"type": "CVSS_V3",
|
||||
@@ -47,7 +47,7 @@
|
||||
"introduced": "2.3.0"
|
||||
},
|
||||
{
|
||||
"fixed": "2.3.3"
|
||||
"fixed": "2.3.2-p2"
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -59,6 +59,10 @@
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-8154"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/magento/product-community-edition/CVE-2019-8154.yaml"
|
||||
},
|
||||
{
|
||||
"type": "PACKAGE",
|
||||
"url": "https://github.com/magento/magento2"
|
||||
|
||||
@@ -1,13 +1,13 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-775w-gx3f-4j4f",
|
||||
"modified": "2023-09-26T19:28:08Z",
|
||||
"modified": "2024-02-12T11:53:50Z",
|
||||
"published": "2022-05-24T17:00:29Z",
|
||||
"aliases": [
|
||||
"CVE-2019-8156"
|
||||
],
|
||||
"summary": "Magento 2 Community Edition SSRF vulnerability",
|
||||
"details": "A server-side request forgery (SSRF) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with admin privileges to modify store configurations can manipulate the connector api endpoint to enable remote code execution.",
|
||||
"details": "A server-side request forgery (SSRF) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with admin privileges to modify store configurations can manipulate the connector api endpoint to enable remote code execution.\n\nAs per [the Magento Release 2.3.3](https://web.archive.org/web/20201126132230/https://devdocs.magento.com/guides/v2.3/release-notes/release-notes-2-3-3-commerce.html#new-security-only-patch-available), if you have already implemented the pre-release version of this patch (2.3.2-p1), it is highly recommended to promptly upgrade to 2.3.2-p2.",
|
||||
"severity": [
|
||||
{
|
||||
"type": "CVSS_V3",
|
||||
@@ -47,7 +47,7 @@
|
||||
"introduced": "2.3.0"
|
||||
},
|
||||
{
|
||||
"fixed": "2.3.2-p1"
|
||||
"fixed": "2.3.2-p2"
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -59,10 +59,18 @@
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-8156"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/magento/product-community-edition/CVE-2019-8156.yaml"
|
||||
},
|
||||
{
|
||||
"type": "PACKAGE",
|
||||
"url": "https://github.com/magento/magento2"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://web.archive.org/web/20220121051105/https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update"
|
||||
|
||||
@@ -1,13 +1,13 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-8p5c-f836-m4h7",
|
||||
"modified": "2023-09-26T19:28:50Z",
|
||||
"modified": "2024-02-12T11:54:10Z",
|
||||
"published": "2022-05-24T17:00:29Z",
|
||||
"aliases": [
|
||||
"CVE-2019-8158"
|
||||
],
|
||||
"summary": "Magento 2 Community Edition XML Injection",
|
||||
"details": "An XPath entity injection vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An attacker can craft a GET request to page cache block rendering module that gets passed to XML data processing engine without validation. The crafted key/value GET request data allows an attacker to limited access to underlying XML data.",
|
||||
"details": "An XPath entity injection vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An attacker can craft a GET request to page cache block rendering module that gets passed to XML data processing engine without validation. The crafted key/value GET request data allows an attacker to limited access to underlying XML data.\n\nAs per [the Magento Release 2.3.3](https://web.archive.org/web/20201126132230/https://devdocs.magento.com/guides/v2.3/release-notes/release-notes-2-3-3-commerce.html#new-security-only-patch-available), if you have already implemented the pre-release version of this patch (2.3.2-p1), it is highly recommended to promptly upgrade to 2.3.2-p2.",
|
||||
"severity": [
|
||||
{
|
||||
"type": "CVSS_V3",
|
||||
@@ -47,7 +47,7 @@
|
||||
"introduced": "2.3.0"
|
||||
},
|
||||
{
|
||||
"fixed": "2.3.2-p1"
|
||||
"fixed": "2.3.2-p2"
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -59,10 +59,18 @@
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-8158"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/magento/product-community-edition/CVE-2019-8158.yaml"
|
||||
},
|
||||
{
|
||||
"type": "PACKAGE",
|
||||
"url": "https://github.com/magento/magento2"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://web.archive.org/web/20220121051105/https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update"
|
||||
|
||||
Reference in New Issue
Block a user