SQL injection in Magento Open Source - CVE-2019-7139
Published: April 10, 2019 / Updated: November 28, 2025
Vulnerability identifier: #VU31120
CSH Severity: High
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Amber
CVE-ID: CVE-2019-7139
CWE-ID: CWE-89
Exploitation vector: Remote access
Exploit availability:
Public exploit is available
Vendor: Adobe
Affected software:
Magento Open Source
Magento Open Source
Detailed vulnerability description
The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.
An unauthenticated user can execute SQL statements that allow arbitrary read access to the underlying database, which causes sensitive data leakage. This issue is fixed in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2.
How to mitigate CVE-2019-7139
Install update from vendor's website.