{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:magento:magento:*:*:*:*:commerce:*:*:*",
              "matchCriteriaId": "24318637-C95B-4811-87F5-14A6F4EDE2EC",
              "versionEndExcluding": "2.2.10",
              "versionStartIncluding": "2.2.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:magento:magento:*:*:*:*:open_source:*:*:*",
              "matchCriteriaId": "A06CF88F-F067-4058-9306-864FEA3D7062",
              "versionEndExcluding": "2.2.10",
              "versionStartIncluding": "2.2.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:magento:magento:*:*:*:*:commerce:*:*:*",
              "matchCriteriaId": "B720D2FA-A6FD-49A3-8B78-07993560081D",
              "versionEndExcluding": "2.3.2",
              "versionStartIncluding": "2.3.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:magento:magento:*:*:*:*:open_source:*:*:*",
              "matchCriteriaId": "6B8C5A27-2957-4373-B0FE-8C7585B4B04E",
              "versionEndExcluding": "2.3.2",
              "versionStartIncluding": "2.3.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:magento:magento:2.3.2:-:*:*:commerce:*:*:*",
              "matchCriteriaId": "ED7EB5B4-33F4-4389-BCA4-50A113F8C719",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:magento:magento:2.3.2:-:*:*:open_source:*:*:*",
              "matchCriteriaId": "465133F9-0BFE-491E-8FE8-A263F9E2FC1D",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with privileges to modify product catalogs can trigger PHP file inclusion through a crafted XML file that specifies product design update."
    },
    {
      "lang": "es",
      "value": "Existe una vulnerabilidad de ejecuci\u00f3n de c\u00f3digo remota en Magento versiones 2.2 anteriores a la versi\u00f3n 2.2.10, Magento versiones 2.3 anteriores a 2.3.3 o 2.3.2-p1. Un usuario autenticado con privilegios para modificar los cat\u00e1logos de productos puede desencadenar una inclusi\u00f3n de archivos PHP por medio de un archivo XML dise\u00f1ado que especifica la actualizaci\u00f3n del dise\u00f1o del producto."
    }
  ],
  "id": "CVE-2019-8154",
  "lastModified": "2024-11-21T04:49:23.167",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "LOW",
          "accessVector": "NETWORK",
          "authentication": "SINGLE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 6.5,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 8.0,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2019-11-06T00:15:12.703",
  "references": [
    {
      "source": "psirt@adobe.com",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update"
    }
  ],
  "sourceIdentifier": "psirt@adobe.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-829"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}