CVE-2019-7942
HIGHMagento 2.1.0-2.1.17, 2.2.0-2.2.8, 2.3.0-2.3.1 - Authenticated Remote Code Execution via XML Layout Updates
Title source: llmDescription
A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with admin privileges to create or edit a product can execute arbitrary code via malicious XML layout updates.
References (1)
Core 1
Core References
Vendor Advisory x_refsource_confirm
https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13
Scores
CVSS v3
7.2
EPSS
0.0090
EPSS Percentile
75.9%
Attack Vector
NETWORK
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Details
Status
published
Products (2)
magento/community-edition
2.1.0 - 2.1.18Packagist
magento/magento
2.1.0 - 2.1.18
Published
Aug 02, 2019
Tracked Since
Feb 18, 2026