VulnerabilityModified
CVE-2019-7859
A path traversal vulnerability in the WYSIWYG editor for Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 could result in unauthorized access to uploaded images due to insufficient access control.
HIGH 7.5EPSS 1.45%
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.45%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
A path traversal vulnerability in the WYSIWYG editor for Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 could result in unauthorized access to uploaded images due to insufficient access control.
- CVSS 3.0
- 7.5 HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- EPSS
- 1.45% probability · 72th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-22
- Affected
- magento/magento
- Source
- psirt@adobe.com
References
- https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-24Not Applicable, Vendor Advisory
- https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23Vendor Advisory
- https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-24Not Applicable, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.