GHSA-qp43-2vhf-cj8g

Magento Remote code execution through support/output path modification

At a glance

Published: 2022-05-24 17:00 UTC
Updated: 2024-01-10 21:56 UTC
CVE: CVE-2019-8230
CVSS_V3: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Description

In Magento Open Source prior to 1.9.4.3, and Magento Commerce prior to 1.14.4.3, an authenticated user with administrative privileges to edit configuration settings can execute arbitrary code through a crafted support/output path.

Affected packages

Package	Versions
Packagist · magento/core	introduced 0, fixed 1.9.4.3

References

https://nvd.nist.gov/vuln/detail/CVE-2019-8230 ADVISORY
https://magento.com/security/patches/supee-11219 WEB

Sources

Source	Licence
OSV.dev	CC-BY 4.0 — GitHub Advisory Database