Vulnerability identifier: #VU30930
Vulnerability risk: Medium
CVSSv3.1: 6.3 [CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C]
CVE-ID:
CWE-ID:
CWE-434
Exploitation vector: Network
Exploit availability: No
Vulnerable software:
Magento Open Source
Web applications /
E-Commerce systems
Vendor: Magento, Inc
Description
The vulnerability allows a remote privileged user to execute arbitrary code.
A file upload restriction bypass exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with administrator privileges to the import feature can make modifications to a configuration file, resulting in potentially unauthorized removal of file upload restrictions. This can result in arbitrary code execution when a malicious file is then uploaded and executed on the system.
Mitigation
Install update from vendor's website.
Vulnerable software versions
Magento Open Source: 2.3.0 - 2.3.1
External links
http://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13
Can this vulnerability be exploited remotely?
Yes. This vulnerability can be exploited by a remote authenticated privileged user via the Internet.
Is there known malware, which exploits this vulnerability?
No. We are not aware of malware exploiting this vulnerability.