Description
A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with privileges to modify product catalogs can trigger PHP file inclusion through a crafted XML file that specifies product design update.
Scores
CVSS v3
8.8
EPSS
0.0112
EPSS Percentile
78.4%
Attack Vector
NETWORK
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Details
CWE
CWE-829
Status
published
Products (3)
magento/community-edition
2.2.0 - 2.2.10Packagist
magento/magento
2.3.2 (2 CPE variants)
magento/magento
2.2.0 - 2.2.10 (2 CPE variants)
Published
Nov 06, 2019
Tracked Since
Feb 18, 2026