#VU31120 SQL injection in Magento Open Source - CVE-2019-7139

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU31120

#VU31120 SQL injection in Magento Open Source - CVE-2019-7139

Published: April 10, 2019 / Updated: November 28, 2025


Vulnerability identifier: #VU31120
Vulnerability risk: High
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Amber
CVE-ID: CVE-2019-7139
CWE-ID: CWE-89
Exploitation vector: Remote access
Exploit availability: Public exploit is available
Vulnerable software:
Magento Open Source
Software vendor:
Adobe

Description

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

An unauthenticated user can execute SQL statements that allow arbitrary read access to the underlying database, which causes sensitive data leakage. This issue is fixed in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2.


Remediation

Install update from vendor's website.

External links