CVE-2019-8231 Magento Remote code execution through catalog attribute sets
Authenticated administrators can execute arbitrary code via custom layout modifications in Magento, requiring an upgrade to secure the platform.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2019-8231?
CVE-2019-8231 is a high-severity code injection vulnerability in Magento Magento, published on 5 Nov 2019. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
In Magento to 1.9.4.3 and Magento prior to 1.14.4.3, an authenticated user with administrative privileges for editing attribute sets can execute arbitrary code through custom layout modification.
Which versions are affected by CVE-2019-8231?
2 open source packages ship an affected version, including magento/core. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
magento/core Packagist | All versions | 1.9.4.3 |
magento/core Packagist | All versions | 1.9.4.3 |
Products include Magento Magento.
How do I fix CVE-2019-8231?
Upgrade magento/core to 1.9.4.3 or later.
Upgrade, and never evaluate templates, expressions or code built from user input. More about Code injection.
Is CVE-2019-8231 being exploited?
There is no known exploitation of CVE-2019-8231 in the wild and no public exploit code.
Other vulnerabilities in Magento Magento
Sources
Also known as GHSA-qpc8-m2xm-9w75.