CVE-2019-8158: Magento 2 Community Edition XML Injection
Summary
CVE-2019-8158: Magento 2 Community Edition XML Injection. Affects magento/community-edition across 2 version ranges.
>= 2.2.0, < 2.2.10
>= 2.3.0, < 2.3.2-p2
Fixed in 2.2.10 or 2.3.2-p2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Magento 2 Community Edition is an open-source e-commerce platform that provides a wide range of features for online stores. It is widely used for its flexibility, scalability, and extensive customization options. However, versions prior to 2.2.10, 2.3.3, or 2.3.2-p1 are vulnerable to an XPath entity injection vulnerability. This vulnerability allows an attacker to exploit the page cache block rendering module by crafting a malicious GET request. The request is then passed to the XML data processing engine without proper validation, enabling the attacker to gain limited access to underlying XML data.
Vulnerability Detail
The XPath entity injection vulnerability in Magento 2 Community Edition exposes the application to potential attacks. By manipulating the key/value pairs in a crafted GET request, an attacker can bypass XML data validation and gain unauthorized access to sensitive information. This can lead to various consequences, including data leakage, privilege escalation, and potential remote code execution. The severity of this vulnerability is rated as CRITICAL with a CVSS score of 9.8.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.2.0, < 2.2.102.2.10composer require magento/community-edition:2.2.10 -
>= 2.3.0, < 2.3.2-p22.3.2-p2composer require magento/community-edition:2.3.2-p2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading to the latest patched version of Magento 2 Community Edition.
Conclusion
The XPath entity injection vulnerability in Magento 2 Community Edition poses a significant risk to the security of e-commerce stores. It is crucial to promptly upgrade to the latest patched version to mitigate the potential consequences of this vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for magento/community-edition →
FAQ
Magento 2 Community Edition is an open-source e-commerce platform known for its flexibility and extensive customization options.
An XPath entity injection vulnerability allows an attacker to manipulate XML data by crafting malicious requests, potentially leading to unauthorized access and other security risks.
This vulnerability can result in data leakage, privilege escalation, and potential remote code execution, posing significant risks to the affected application.
To fix this vulnerability, it is recommended to upgrade to the latest patched version of Magento 2 Community Edition.
No, there is no known workaround for this vulnerability. Upgrading to the patched version is the recommended solution.
Related vulnerabilities
Recent vulnerabilities recorded for magento/community-edition.
