CVE-2019-7923

HIGH

Magento 2.1.0-2.1.17, 2.2.0-2.2.8, 2.3.0-2.3.1 - Authenticated Server-Side Request Forgery in Shipment Settings

Title source: llm

Description

A server-side request forgery (SSRF) vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can be exploited by authenticated user with admin privileges to manipulate shipment settings to execute arbitrary code.

References (1)

Core 1

Core References

Vendor Advisory x_refsource_confirm

https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13

Scores

CVSS v3 7.2

EPSS 0.0025

EPSS Percentile 48.7%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Details

CWE

CWE-918

Status published

Products (2)

magento/community-edition 2.1.0 - 2.1.18Packagist

magento/magento 2.1.0 - 2.1.18

Published Aug 02, 2019

Tracked Since Feb 18, 2026