Vulnerability Description
A path traversal vulnerability in the WYSIWYG editor for Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 could result in unauthorized access to uploaded images due to insufficient access control.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Magento | Magento | >= 2.1.0, < 2.1.18 |
Related Weaknesses (CWE)
References
- https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-updNot ApplicableVendor Advisory
- https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-updVendor Advisory
- https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-updNot ApplicableVendor Advisory
FAQ
What is CVE-2019-7859?
CVE-2019-7859 is a vulnerability with a CVSS score of 7.5 (HIGH). A path traversal vulnerability in the WYSIWYG editor for Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 could result in unauthorized access to uploaded images due ...
How severe is CVE-2019-7859?
CVE-2019-7859 has been rated HIGH with a CVSS base score of 7.5/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2019-7859?
Check the references section above for vendor advisories and patch information. Affected products include: Magento Magento.