CVE-2019-8130

A SQL injection vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. A user with store manipulation privileges can execute arbitrary SQL queries by getting access to the database connection through group instance in email templates.
SQL Injection
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
8.8 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
adobeCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 34%
VendorProductVersion
magentomagento
2.2.0 ≤
𝑥
< 2.2.10
magentomagento
2.2.0 ≤
𝑥
< 2.2.10
magentomagento
2.3.0 ≤
𝑥
< 2.3.2
magentomagento
2.3.0 ≤
𝑥
< 2.3.2
magentomagento
2.3.2
magentomagento
2.3.2
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update
https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update