What is GHSA-qp43-2vhf-cj8g?

GHSA-qp43-2vhf-cj8g is a security advisory published by GitHub Security Advisories with High severity. Magento Remote code execution through support/output path modification

Which CVE IDs does GHSA-qp43-2vhf-cj8g cover?

GHSA-qp43-2vhf-cj8g covers the following CVE IDs: CVE-2019-8230. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-qp43-2vhf-cj8g?

GHSA-qp43-2vhf-cj8g has a CVSS v3 base score of 7.2, published by GitHub Security Advisories.

Which products are affected by GHSA-qp43-2vhf-cj8g?

GHSA-qp43-2vhf-cj8g affects 1 product, including: composer/magento/core:\u003c 1.9.4.3.

GHSA-qp43-2vhf-cj8gHighCVSS 7.2

Magento Remote code execution through support/output path modification

Vendor

GitHub Security Advisories

Published

May 24, 2022

Last Modified

January 10, 2024

🔗 CVE IDs covered (1)

CVE-2019-8230 →

📋 Description

In Magento Open Source prior to 1.9.4.3, and Magento Commerce prior to 1.14.4.3, an authenticated user with administrative privileges to edit configuration settings can execute arbitrary code through a crafted support/output path.

🎯 Affected products1

composer/magento/core:< 1.9.4.3

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2019-8230
https://magento.com/security/patches/supee-11219
https://github.com/advisories/GHSA-qp43-2vhf-cj8g