CVE-2019-8230: Magento Remote code execution through support/output path modification
Summary
CVE-2019-8230: Magento Remote code execution through support/output path modification. Affects magento/core versions < 1.9.4.3. Fixed in 1.9.4.3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Magento is an open-source e-commerce platform that allows businesses to create and manage online stores. It provides a wide range of features for product catalog management, order processing, payment integration, and more. The 'magento/core' package is a core component of Magento that handles various functionalities of the platform.
Vulnerability Detail
This vulnerability in Magento Open Source prior to 1.9.4.3, and Magento Commerce prior to 1.14.4.3, allows an authenticated user with administrative privileges to edit configuration settings to execute arbitrary code through a crafted support/output path. By manipulating the support/output path, an attacker can inject and execute malicious code on the server, potentially leading to unauthorized access, data breaches, or further compromise of the system.
How To Fix
Minimum fixed version
1.9.4.3
This is the first release that contains the fix.
composer require magento/core:1.9.4.3Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended updates to ensure the security of the Magento installation.
Conclusion
In conclusion, the vulnerability in Magento allows an authenticated user with administrative privileges to execute arbitrary code through a crafted support/output path. It is crucial to update Magento to the recommended versions to mitigate the risk of unauthorized access and potential compromise of the system. For further assistance with vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for magento/core →
FAQ
Magento is an open-source e-commerce platform used for creating and managing online stores.
The 'magento/core' package is a core component of Magento that handles various functionalities of the platform.
This vulnerability allows an attacker to execute arbitrary code on the server, potentially leading to unauthorized access, data breaches, or further compromise of the system.
To fix this vulnerability, update Magento Open Source to version 1.9.4.3 or later, and Magento Commerce to version 1.14.4.3 or later.
No, there is no known workaround for this vulnerability. Applying the recommended updates is the best course of action.
References
Related vulnerabilities
Recent vulnerabilities recorded for magento/core.
