ASA-2019-00400 – Magento: Arbitrary code execution via malicious XML layouts


Allele Security Alert

ASA-2019-00400

Identifier(s)

ASA-2019-00400, CVE-2019-7942, PRODSECBUG-2375

Title

Arbitrary code execution through design layout update

Vendor(s)

Magento, Inc

Product(s)

Magento

Affected version(s)

Magento 2.1.x versions prior to 2.1.18
Magento 2.2.x versions prior to 2.2.9
Magento 2.3.x versions prior to 2.3.2

Fixed version(s)

Magento version 2.1.18
Magento version 2.2.9
Magento version 2.3.2

Proof of concept

Unknown

Description

An authenticated user with admin privileges can execute arbitrary code when creating a product via malicious XML layouts.

Technical details

Unknown

Credits

Charles Fol

Reference(s)

PRODSECBUG-2296: Arbitrary code execution through design layout update – CVE-2019-7895
https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13

CVE-2019-7942
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-7942

CVE-2019-7942
https://nvd.nist.gov/vuln/detail/CVE-2019-7942

If there is any error in this alert or you wish a comprehensive analysis, let us know.

Last modified: June 29, 2019

We are not responsible for any data loss, device corruption or any other type of issue due to the use of any information mentioned in our security alerts.