mirror of
https://github.com/netbirdio/advisory-database.git
synced 2026-05-22 18:04:22 -07:00
Publish Advisories
GHSA-427g-2r83-3ccm GHSA-2x2q-2xpv-mcf9 GHSA-6m27-3r8q-c7f7
This commit is contained in:
advisory-database[bot]
@@ -1,13 +1,13 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-427g-2r83-3ccm",
|
||||
"modified": "2021-07-28T15:37:48Z",
|
||||
"modified": "2024-02-12T11:49:40Z",
|
||||
"published": "2019-11-12T22:59:24Z",
|
||||
"aliases": [
|
||||
"CVE-2019-8126"
|
||||
],
|
||||
"summary": "Information disclosure through processing of external XML entities",
|
||||
"details": "An XML entity injection vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated admin user can craft document type definition for an XML representing XML layout. The crafted document type definition and XML layout allow processing of external entities which can lead to information disclosure.",
|
||||
"details": "An XML entity injection vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated admin user can craft document type definition for an XML representing XML layout. The crafted document type definition and XML layout allow processing of external entities which can lead to information disclosure.\n\nAs per [the Magento Release 2.3.3](https://web.archive.org/web/20201126132230/https://devdocs.magento.com/guides/v2.3/release-notes/release-notes-2-3-3-commerce.html#new-security-only-patch-available), if you have already implemented the pre-release version of this patch (2.3.2-p1), it is highly recommended to promptly upgrade to 2.3.2-p2.",
|
||||
"severity": [
|
||||
{
|
||||
"type": "CVSS_V3",
|
||||
@@ -47,7 +47,7 @@
|
||||
"introduced": "2.3"
|
||||
},
|
||||
{
|
||||
"fixed": "2.3.3"
|
||||
"fixed": "2.3.2-p2"
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -59,6 +59,10 @@
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-8126"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/magento/product-community-edition/CVE-2019-8126.yaml"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update"
|
||||
|
||||
@@ -1,13 +1,13 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-2x2q-2xpv-mcf9",
|
||||
"modified": "2023-09-26T19:10:43Z",
|
||||
"modified": "2024-02-12T11:48:50Z",
|
||||
"published": "2022-05-24T17:00:25Z",
|
||||
"aliases": [
|
||||
"CVE-2019-8127"
|
||||
],
|
||||
"summary": "Magento 2 Community Edition SQLi Vulnerability",
|
||||
"details": "A SQL injection vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with privileges to an account with Newsletter Template editing permission could exfiltrate the Admin login data, and reset their password, effectively performing a privilege escalation.",
|
||||
"details": "A SQL injection vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with privileges to an account with Newsletter Template editing permission could exfiltrate the Admin login data, and reset their password, effectively performing a privilege escalation.\n\nAs per [the Magento Release 2.3.3](https://web.archive.org/web/20201126132230/https://devdocs.magento.com/guides/v2.3/release-notes/release-notes-2-3-3-commerce.html#new-security-only-patch-available), if you have already implemented the pre-release version of this patch (2.3.2-p1), it is highly recommended to promptly upgrade to 2.3.2-p2.\n",
|
||||
"severity": [
|
||||
{
|
||||
"type": "CVSS_V3",
|
||||
@@ -47,7 +47,7 @@
|
||||
"introduced": "2.3.0"
|
||||
},
|
||||
{
|
||||
"fixed": "2.3.2-p1"
|
||||
"fixed": "2.3.2-p2"
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -59,10 +59,18 @@
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-8127"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/magento/product-community-edition/CVE-2019-8127.yaml"
|
||||
},
|
||||
{
|
||||
"type": "PACKAGE",
|
||||
"url": "https://github.com/magento/magento2"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://web.archive.org/web/20220121051105/https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update"
|
||||
|
||||
@@ -1,13 +1,13 @@
|
||||
{
|
||||
"schema_version": "1.4.0",
|
||||
"id": "GHSA-6m27-3r8q-c7f7",
|
||||
"modified": "2023-09-26T19:23:09Z",
|
||||
"modified": "2024-02-12T11:50:25Z",
|
||||
"published": "2022-05-24T17:00:28Z",
|
||||
"aliases": [
|
||||
"CVE-2019-8146"
|
||||
],
|
||||
"summary": "Magento 2 Community Edition XSS Vulnerability",
|
||||
"details": "A stored cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can inject arbitrary JavaScript code when adding a new customer attribute for stores.",
|
||||
"details": "A stored cross-site scripting (XSS) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can inject arbitrary JavaScript code when adding a new customer attribute for stores.\n\nAs per [the Magento Release 2.3.3](https://web.archive.org/web/20201126132230/https://devdocs.magento.com/guides/v2.3/release-notes/release-notes-2-3-3-commerce.html#new-security-only-patch-available), if you have already implemented the pre-release version of this patch (2.3.2-p1), it is highly recommended to promptly upgrade to 2.3.2-p2.\n",
|
||||
"severity": [
|
||||
{
|
||||
"type": "CVSS_V3",
|
||||
@@ -47,7 +47,7 @@
|
||||
"introduced": "2.3.0"
|
||||
},
|
||||
{
|
||||
"fixed": "2.3.2-p1"
|
||||
"fixed": "2.3.2-p2"
|
||||
}
|
||||
]
|
||||
}
|
||||
@@ -59,10 +59,18 @@
|
||||
"type": "ADVISORY",
|
||||
"url": "https://nvd.nist.gov/vuln/detail/CVE-2019-8146"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://github.com/FriendsOfPHP/security-advisories/blob/master/magento/product-community-edition/CVE-2019-8146.yaml"
|
||||
},
|
||||
{
|
||||
"type": "PACKAGE",
|
||||
"url": "https://github.com/magento/magento2"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update"
|
||||
},
|
||||
{
|
||||
"type": "WEB",
|
||||
"url": "https://web.archive.org/web/20220121051105/https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update"
|
||||
|
||||
Reference in New Issue
Block a user