GHSA-7pr3-34rg-g53m

Magento Unrestricted file upload vulnerability

Source: GitHub Advisory Database (reviewed) Moderate CVE-2019-8140

Packages

Ecosystem	Package	Affected	Fixed in
Packagist	magento/community-edition	>= 2.2.0, < 2.2.10	2.2.10
Packagist	magento/community-edition	>= 2.3.0, < 2.3.3	2.3.3

Details

As written in the advisory (Markdown source, shown as plain text).

An unrestricted file upload vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated admin user can manipulate the Synchronization feature in the Media File Storage of the database to transform uploaded JPEG file into a PHP file.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2019-8140 advisory
https://github.com/FriendsOfPHP/security-advisories/blob/master/magento/product-community-edition/CVE-2019-8140.yaml web
https://github.com/magento/magento2 package
https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update web