Magento up to 2.1.17/2.2.8/2.3.1 7pk security

Summaryinfo

A vulnerability classified as critical was found in Magento up to 2.1.17/2.2.8/2.3.1. This impacts an unknown function. Such manipulation leads to 7pk security. This vulnerability is uniquely identified as CVE-2019-7871. The attack can be launched remotely. No exploit exists. Upgrading the affected component is advised.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Magento up to 2.1.17/2.2.8/2.3.1. Affected by this issue is an unknown function. The manipulation with an unknown input leads to a 7pk security vulnerability. Using CWE to declare the problem leads to CWE-254. Impacted is confidentiality, integrity, and availability. CVE summarizes:

A security bypass exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 that could be abused to execute arbitrary PHP code. An authenticated user can bypass security protections that prevent arbitrary PHP script upload via form data injection.

The weakness was disclosed 08/02/2019 (Website). The advisory is shared for download at magento.com. This vulnerability is handled as CVE-2019-7871 since 02/12/2019. The exploitation is known to be easy. The attack may be launched remotely. The successful exploitation requires a simple authentication. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1211.

Upgrading to version 2.1.18, 2.2.9 or 2.3.2 eliminates this vulnerability.

The entries VDB-133339, VDB-139403, VDB-139404 and VDB-139413 are pretty similar. Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• E-Commerce Management Software

Name

• Magento

Version

• 2.1.0
• 2.1.1
• 2.1.2
• 2.1.3
• 2.1.4
• 2.1.5
• 2.1.6
• 2.1.7
• 2.1.8
• 2.1.9
• 2.1.10
• 2.1.11
• 2.1.12
• 2.1.13
• 2.1.14
• 2.1.15
• 2.1.16
• 2.1.17
• 2.2.0
• 2.2.1
• 2.2.2
• 2.2.3
• 2.2.4
• 2.2.5
• 2.2.6
• 2.2.7
• 2.2.8
• 2.3.0
• 2.3.1

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion