En resumen
- CVE-2019-7912 es una vulnerabilidad ALTO (CVSS 7.2) que afecta a magento/community-edition, magento (magento).
- Probabilidad de explotación en los próximos 30 días (EPSS): 1.6%, mayor que el 75.6% de las vulnerabilidades.
- Solución: actualizar a 2.1.18, 2.2.9, 2.3.2 o posterior.
| Package | Affected versions | Patched versions |
|---|
| magento/community-edition Packagist | ≥ 2.1, < 2.1.18≥ 2.2, < 2.2.9≥ 2.3, < 2.3.2
| 2.1.182.2.92.3.2
|
| magento | ≥ 2.1.0, < 2.1.18≥ 2.2.0, < 2.2.9≥ 2.3.0, < 2.3.2
| 2.1.182.2.92.3.2
|
Description
A file upload filter bypass exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can be exploited by an authenticated user with admin privileges to edit configuration keys to remove file extension filters, potentially resulting in the malicious upload and execution of malicious files on the server.
NVD description
A file upload filter bypass exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can be exploited by an authenticated user with admin privileges to edit configuration keys to remove file extension filters, potentially resulting in the malicious upload and execution of malicious files on the server.
Más vulnerabilidades de magento/community-edition
Ver todo →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free