Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
8.8

Mageento 2.2 and 2.3 allow authenticated users to run malicious code

CVE-2019-8159 · published 7 years ago
Summary

A security flaw in certain versions of Magento allows a user with administrative access to execute unauthorized code on the system. This could potentially allow the user to delete files, run malicious commands, or take other actions on the server. If you're running an affected version, update to the latest patched version as soon as possible.

What to do
  • Update magento community-edition to version 2.2.10.
  • Update magento community-edition to version 2.3.2-p2.
Affected software
Ecosystem VendorProductAffected versions
composer magento community-edition >= 2.2, < 2.2.10
>= 2.3, < 2.3.2-p2
Fix: upgrade to 2.2.10
– magento magento >= 2.2.0, < 2.2.10
>= 2.3.0, < 2.3.2
2.3.2
cpe:2.3:a:magento:magento:*:*:*:*:commerce:*:*:*
Original advisory text
A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with system data manipulation privileges can execute aribi...
A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with system data manipulation privileges can execute aribitrary code through arbitrary file deletion and OS command injection.
References
Fix within
Internet-facing 14 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit (estimated)
  • Gives an attacker full control (estimated)
Severity
8.8 High
Exploitation
3% chance of attack within 30 days
Type
CWE-78OS Command Injection
Timeline
Published6 Nov 2019
Updated4 Nov 2026
First seen6 Mar 2026
Sources
GHSA-47h6-hfpv-7phj · GHSA
CVE-2019-8159 · NVD
Track software like this
Free during beta