What is GHSA-427g-2r83-3ccm?

GHSA-427g-2r83-3ccm is a security advisory published by GitHub Security Advisories with Medium severity. Information disclosure through processing of external XML entities

Which CVE IDs does GHSA-427g-2r83-3ccm cover?

GHSA-427g-2r83-3ccm covers the following CVE IDs: CVE-2019-8126. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-427g-2r83-3ccm?

GHSA-427g-2r83-3ccm has a CVSS v3 base score of 4.9, published by GitHub Security Advisories.

Which products are affected by GHSA-427g-2r83-3ccm?

GHSA-427g-2r83-3ccm affects 2 products, including: composer/magento/community-edition:\u003e= 2.2, \u003c 2.2.10; composer/magento/community-edition:\u003e= 2.3, \u003c 2.3.2-p2.

GHSA-427g-2r83-3ccmMediumCVSS 4.9

Information disclosure through processing of external XML entities

Vendor

GitHub Security Advisories

Published

November 12, 2019

Last Modified

February 12, 2024

🔗 CVE IDs covered (1)

CVE-2019-8126 →

📋 Description

An XML entity injection vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated admin user can craft document type definition for an XML representing XML layout. The crafted document type definition and XML layout allow processing of external entities which can lead to information disclosure.

As per the Magento Release 2.3.3, if you have already implemented the pre-release version of this patch (2.3.2-p1), it is highly recommended to promptly upgrade to 2.3.2-p2.

🎯 Affected products2

composer/magento/community-edition:>= 2.2, < 2.2.10
composer/magento/community-edition:>= 2.3, < 2.3.2-p2

🔗 References (4)

https://nvd.nist.gov/vuln/detail/CVE-2019-8126
https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update
https://github.com/FriendsOfPHP/security-advisories/blob/master/magento/product-community-edition/CVE-2019-8126.yaml
https://github.com/advisories/GHSA-427g-2r83-3ccm