diff --git a/advisories/github-reviewed/2022/05/GHSA-crv7-r357-gw3w/GHSA-crv7-r357-gw3w.json b/advisories/github-reviewed/2022/05/GHSA-crv7-r357-gw3w/GHSA-crv7-r357-gw3w.json index 0227d709274..551c06db4e2 100644 --- a/advisories/github-reviewed/2022/05/GHSA-crv7-r357-gw3w/GHSA-crv7-r357-gw3w.json +++ b/advisories/github-reviewed/2022/05/GHSA-crv7-r357-gw3w/GHSA-crv7-r357-gw3w.json @@ -1,13 +1,13 @@ { "schema_version": "1.4.0", "id": "GHSA-crv7-r357-gw3w", - "modified": "2024-02-12T11:28:52Z", + "modified": "2025-02-10T20:02:20Z", "published": "2022-05-24T17:00:24Z", "aliases": [ "CVE-2019-8114" ], "summary": "Magento 2 Community Edition RCE Vulnerability", - "details": "A remote code execution vulnerability exists in Magento 1 prior to 1.9.4.3 and 1.14.4.3, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with admin privileges to import features can execute arbitrary code via crafted configuration archive file upload.\n\nAs per [the Magento Release 2.3.3](https://web.archive.org/web/20201126132230/https://devdocs.magento.com/guides/v2.3/release-notes/release-notes-2-3-3-commerce.html#new-security-only-patch-available), if you have already implemented the pre-release version of this patch (2.3.2-p1), it is highly recommended to promptly upgrade to 2.3.2-p2.\n", + "details": "A remote code execution vulnerability exists in Magento 1 prior to 1.9.4.3 and 1.14.4.3, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with admin privileges to import features can execute arbitrary code via crafted configuration archive file upload.\n\nAs per [the Magento Release 2.3.3](https://web.archive.org/web/20201126132230/https://devdocs.magento.com/guides/v2.3/release-notes/release-notes-2-3-3-commerce.html#new-security-only-patch-available), if you have already implemented the pre-release version of this patch (2.3.2-p1), it is highly recommended to promptly upgrade to 2.3.2-p2.", "severity": [ { "type": "CVSS_V3", @@ -71,6 +71,25 @@ ] } ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "magento/project-community-edition" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "1.9.4.3" + } + ] + } + ] } ], "references": [ @@ -78,6 +97,10 @@ "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-8114" }, + { + "type": "WEB", + "url": "https://devdocs-openmage.org/guides/m1x//ce19-ee114/ee1.14_release-notes.html#ee114-11443" + }, { "type": "WEB", "url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/magento/magento1ce/CVE-2019-8114.yaml"