Magento 2 Community Edition RCE Vulnerability
Date: 2022-05
Affected: composer/magento/community-edition, composer/magento/community-edition
Attack vector: rce
Category: vulnerability-disclosure
Severity: High
CVE: CVE-2019-8114
CVE-2019-8123
CVE-2019-8152
CVE-2019-8227
CVE-2019-8228
CVE-2019-8229
CVE-2019-8232
CWE: CWE-362
CWE-434
CWE-778
CWE-79
CVSS: 6.6 (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H)

In Magento prior to 1.9.4.3, Magento prior to 1.14.4.3, Magento 2.2 prior to 2.2.10, and Magento 2.3 prior to 2.3.3 or 2.3.2-p1, an authenticated user with administrative privileges for the import feature can execute arbitrary code through a race condition that allows webserver configuration file modification.


Mitigations:

Architectural layers (MAESTRO):