Magento up to 2.1.18/2.2.9/2.3.2 Phar Deserialization deserialization

Summaryinfo

A vulnerability classified as critical has been found in Magento up to 2.1.18/2.2.9/2.3.2. This issue affects some unknown processing of the component Phar Deserialization. This manipulation causes deserialization. The identification of this vulnerability is CVE-2019-8141. It is possible to initiate the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability has been found in Magento up to 2.1.18/2.2.9/2.3.2 and classified as critical. Affected by this vulnerability is some unknown processing of the component Phar Deserialization. The manipulation with an unknown input leads to a deserialization vulnerability. The CWE definition for the vulnerability is CWE-502. The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

A remote code execution vulnerability exists in Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3. An authenticated user with administrative privileges (system level import) can execute arbitrary code through a Phar deserialization vulnerability in the import functionality.

The weakness was shared 11/06/2019. This vulnerability is known as CVE-2019-8141 since 02/12/2019. The attack can be launched remotely. Required for exploitation is a single authentication. The technical details are unknown and an exploit is not publicly available.

Upgrading to version 2.1.19, 2.2.10 or 2.3.3 eliminates this vulnerability.

The entries VDB-145043, VDB-145042, VDB-145041 and VDB-145040 are related to this item. Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• E-Commerce Management Software

Name

• Magento

Version

• 2.1.0
• 2.1.1
• 2.1.2
• 2.1.3
• 2.1.4
• 2.1.5
• 2.1.6
• 2.1.7
• 2.1.8
• 2.1.9
• 2.1.10
• 2.1.11
• 2.1.12
• 2.1.13
• 2.1.14
• 2.1.15
• 2.1.16
• 2.1.17
• 2.1.18
• 2.2.0
• 2.2.1
• 2.2.2
• 2.2.3
• 2.2.4
• 2.2.5
• 2.2.6
• 2.2.7
• 2.2.8
• 2.2.9
• 2.3.0
• 2.3.1
• 2.3.2

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion