GHSA-9pgc-rvp9-rqv3
Magento 2 Community Edition Information Disclosure
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | magento/community-edition | >= 2.1, < 2.1.18 | 2.1.18 |
| Packagist | magento/community-edition | >= 2.2, < 2.2.9 | 2.2.9 |
| Packagist | magento/community-edition | >= 2.3, < 2.3.2 | 2.3.2 |
Details
As written in the advisory (Markdown source, shown as plain text).
An information disclosure vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with privileges to create email templates could leak sensitive data via a malicious email template.
References
External links from the advisory. They lead to third-party sites.
- https://nvd.nist.gov/vuln/detail/CVE-2019-7888
- https://github.com/FriendsOfPHP/security-advisories/blob/master/magento/product-community-edition/CVE-2019-7888.yaml
- https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-33
- https://web.archive.org/web/20220121011306/https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-33