Main Vulnerability Database Vulnerabilities #VU18098

Insecure deserialization in Magento Open Source and Adobe Commerce (formerly Magento Commerce) - #VU18098

Published: March 30, 2019 / Updated: June 7, 2019

Vulnerability identifier: #VU18098

CSH Severity: Low

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: N/A

CWE-ID: CWE-502

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to insecure deserialization of data passed through Phar archives. A remote administrator can pass a specially crafted phar archive to the application and execute arbitrary PHP code on the system.

Affected software

Magento Open Source
Adobe Commerce (formerly Magento Commerce)

Remediation

Install updates from vendor's website.

Magento Open Source - addressed in versions 1.9.4.1, 2.1.17, 2.2.8, 2.3.1
Adobe Commerce (formerly Magento Commerce) - update to 1.14.4.1

External References

https://magento.com/security/patches/magento-2.3.1-2.2.8-and-2.1.17-security-update

Related Security Bulletins