GHSA-32x5-6p4q-q8jh

Magento Information Disclosure via File upload functionality

Source: GitHub Advisory Database (reviewed) High CVE-2019-8093

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	magento/community-edition	>= 2.2, < 2.2.10	2.2.10
Packagist	magento/community-edition	>= 2.3, < 2.3.2-p1	2.3.2-p1

Details

As written in the advisory (Markdown source, shown as plain text).

An arbitrary file access vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user can leverage file upload controller for downloadable products to read/delete an arbitary files.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2019-8093 advisory
https://github.com/FriendsOfPHP/security-advisories/blob/master/magento/product-community-edition/CVE-2019-8093.yaml web
https://github.com/magento/magento2 package
https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update web