CVE-2019-8156

EUVD-2022-2937
A server-side request forgery (SSRF) vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with admin privileges to modify store configurations can manipulate the connector api endpoint to enable remote code execution.
SSRF
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
7.2 HIGH
NETWORK
LOW
HIGH
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 77%
Affected Products (NVD)
VendorProductVersion
magentomagento
2.2.0 ≤
𝑥
< 2.2.10
magentomagento
2.2.0 ≤
𝑥
< 2.2.10
magentomagento
2.3.0 ≤
𝑥
< 2.3.2
magentomagento
2.3.0 ≤
𝑥
< 2.3.2
magentomagento
2.3.2
magentomagento
2.3.2
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update
https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update