CVE-2019-8090: An arbitrary file deletion vulnerability exists in Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3

Medium severity · published Nov 5, 2019

CVE-2019-8090

An arbitrary file deletion vulnerability exists in Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3

6.5

CVSS

0.8%

EPSS

On KEV

Description

An arbitrary file deletion vulnerability exists in Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3. An authenticated users can manipulate the design layout update feature.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Attack vector

Network

Complexity

Low

Privileges

Low

User interaction

None

Confidentiality

None

Integrity

High

Availability

None

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.8% · higher than 56% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Magento · Magento

2.1.0 before 2.1.19; 2.1.0 before 2.1.19; 2.2.0 before 2.2.10; 2.2.0 before 2.2.10; 2.3.0 before 2.3.2; 2.3.0 before 2.3.2; +2 more · source: NVD

Affected product

Magento

All Magento CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2019-8090

CVE.org

https://www.cve.org/CVERecord?id=CVE-2019-8090

Patch

https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update