CVE-2019-7913

HIGH

Magento 2.1.0-2.1.17 - Authenticated Server-Side Request Forgery via Shipment Method Manipulation

Title source: llm

Description

A server-side request forgery (SSRF) vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can be exploited by an authenticated user with admin privileges to manipulate shipment methods to execute arbitrary code.

References (1)

Core 1

Core References

Vendor Advisory x_refsource_confirm

https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13

Scores

CVSS v3 7.2

EPSS 0.0025

EPSS Percentile 48.7%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-918

Status published

Products (2)

magento/community-edition 2.1.0 - 2.1.18Packagist

magento/magento 2.1.0 - 2.1.18

Published Aug 02, 2019

Tracked Since Feb 18, 2026