CVE-2019-8232

Published Nov 6, 2019

Last updated 4 years ago

CVSS medium 6.6

Overview

Description: In Magento prior to 1.9.4.3, Magento prior to 1.14.4.3, Magento 2.2 prior to 2.2.10, and Magento 2.3 prior to 2.3.3 or 2.3.2-p1, an authenticated user with administrative privileges for the import feature can execute arbitrary code through a race condition that allows webserver configuration file modification.
Source: psirt@adobe.com
NVD status: Analyzed

Risk scores

CVSS 3.1

Type: Primary
Base score: 6.6
Impact score: 5.9
Exploitability score: 0.7
Vector string: CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
Severity: MEDIUM

CVSS 2.0

Type: Primary
Base score: 6
Impact score: 6.4
Exploitability score: 6.8
Vector string: AV:N/AC:M/Au:S/C:P/I:P/A:P

Weaknesses

nvd@nist.gov: CWE-362

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:magento:magento:*:*:*:*:open_source:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "D463F1B6-7A1A-45A6-A2B4-654FAFD0E231",
            "versionEndExcluding": "1.9.4.3",
            "versionStartIncluding": "1.5.0.0"
          },
          {
            "criteria": "cpe:2.3:a:magento:magento:*:*:*:*:commerce:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "795C485A-D4B2-4B67-9766-D00BC6BE7FA1",
            "versionEndExcluding": "1.14.4.3",
            "versionStartIncluding": "1.9.0.0"
          },
          {
            "criteria": "cpe:2.3:a:magento:magento:*:*:*:*:commerce:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "24318637-C95B-4811-87F5-14A6F4EDE2EC",
            "versionEndExcluding": "2.2.10",
            "versionStartIncluding": "2.2.0"
          },
          {
            "criteria": "cpe:2.3:a:magento:magento:*:*:*:*:open_source:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "A06CF88F-F067-4058-9306-864FEA3D7062",
            "versionEndExcluding": "2.2.10",
            "versionStartIncluding": "2.2.0"
          },
          {
            "criteria": "cpe:2.3:a:magento:magento:*:*:*:*:commerce:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "B720D2FA-A6FD-49A3-8B78-07993560081D",
            "versionEndExcluding": "2.3.2",
            "versionStartIncluding": "2.3.0"
          },
          {
            "criteria": "cpe:2.3:a:magento:magento:*:*:*:*:open_source:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "6B8C5A27-2957-4373-B0FE-8C7585B4B04E",
            "versionEndExcluding": "2.3.2",
            "versionStartIncluding": "2.3.0"
          },
          {
            "criteria": "cpe:2.3:a:magento:magento:2.3.2:-:*:*:commerce:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "ED7EB5B4-33F4-4389-BCA4-50A113F8C719"
          },
          {
            "criteria": "cpe:2.3:a:magento:magento:2.3.2:-:*:*:open_source:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "465133F9-0BFE-491E-8FE8-A263F9E2FC1D"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

Overview

Risk scores

CVSS 3.1

CVSS 2.0

Weaknesses

Social media

Configurations

References