CVE-2019-8158

highPriorität · verfolgen · 39EPSS 0.013 · 70. PerzentilEUUS

grimoire priorityP2 · Scheduled

Exploitable?

—

no known exploitation

Likely / severe?

1.29% (70th) EPSS

CVSS 7.5 · high

Is it mine?

7 products

Prüfe deine Angriffsfläche

Who says so?

4 sources

cnnvd · enisa_euvd · nvd · osv

EPSS · bewertet 2026-10-28

An XPath entity injection vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An attacker can craft a GET request to page cache block rendering module that gets passed to XML data processing engine without validation. The crafted key/value GET request data allows an attacker to limited access to underlying XML data.

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

9.8

010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · high–critical · 7.5–9.8

v2.07.5highAV:N/AC:L/Au:N/C:P/I:P/A:Pprimary · NVD / NIST USAusnutzbarkeit 10 · Auswirkung 6.4

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hprimary · NVD / NIST USAusnutzbarkeit 3.9 · Auswirkung 5.9

v3.19.8criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:Hsecondary · OSV

v3.19criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:Usecondary · CVSS-BT (t0sche)

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-91USprimärCWE-91US

betroffene Produkte (7)

Betroffene Produkte und Versionsbereiche.

Adobe Systems Incorporated Magento 2≤ Magento 2.3 prior to 2.3.3 or 2.3.2-p1enisa_euvdEU
Adobe Systems Incorporated Magento 2≤ Magento 2.2 prior to 2.2.10enisa_euvdEU
magento magento2.2.0 → 2.2.10nvdUScpe:2.3:a:magento:magento:*:*:*:*:*:*:*:*
magento magento2.3.0 → 2.3.2nvdUScpe:2.3:a:magento:magento:*:*:*:*:*:*:*:*
magento magento= 2.3.2nvdUScpe:2.3:a:magento:magento:*:*:*:*:*:*:*:*
Packagist magento/community-edition2.2.0 → 2.2.10osvUSpkg:composer/magento/community-edition
Packagist magento/community-edition2.3.0 → 2.3.2-p2osvUSpkg:composer/magento/community-edition

Advisories (1)

Hersteller- und Ökosystem-Meldungen dazu.

GHSA-8p5c-f836-m4h7Magento 2 Community Edition XML Injection2022-05-24ghsa · osvUS
An XPath entity injection vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An attacker can craft a GET request to page cache block rendering module that gets passed to XML data processing engine without validation. The crafted key/value GET request data allows an attacker to limited access to underlying XML data. As per [the Magento Release 2.3.3](https://web.archive.org/web/20201126132230/https://devdocs.magento.com/guides/v2.3/release-notes/release-notes-2-3-3-commerce.html#new-security-only-patch-available), if you have already implemented the pre-release version of this patch (2.3.2-p1), it is highly recommended to promptly upgrade to 2.3.2-p2.

auch bekannt als (3)

Weitere Namen und Kennungen dieser Entität.

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvd enisa_euvd nvd osv NVD CVE.org MITRE

veröffentlicht 2019-11-06geändert 2026-06-17

verwandt (202)

Verwandte Einträge.

ID	Schweregrad	EPSS	ausnutzbar	veröffentlicht
CVE-2020-1147US	high7.8OT kritisch	94.0% (100th)	KEV	2020-07-14
A remote code execution vulnerability exists in .NET Framework, Microsoft SharePoint, and Visual Studio when the software fails to check the source markup of XML file input, aka '.…
CVE-2020-0646US	critical9.8OT kritisch	99.2% (100th)	KEV	2020-01-14
A remote code execution vulnerability exists when the Microsoft .NET Framework fails to validate input properly, aka '.NET Framework Remote Code Execution Injection Vulnerability'.
CVE-2023-46214US	high8.8	89.2% (100th)	Exploit	2023-11-16
In Splunk Enterprise versions below 9.0.7 and 9.1.2, Splunk Enterprise does not safely sanitize extensible stylesheet language transformations (XSLT) that users supply. This means…
CVE-2023-27253US	high8.8	89.5% (100th)	Exploit	2023-03-17
A command injection vulnerability in the function restore_rrddata() of Netgate pfSense v2.7.0 allows authenticated attackers to execute arbitrary commands via manipulating the cont…
CVE-2008-0016US	high10.0	43.9% (99th)	Exploit	2008-09-24
Stack-based buffer overflow in the URL parsing implementation in Mozilla Firefox before 2.0.0.17 and SeaMonkey before 1.1.12 allows remote attackers to execute arbitrary code via a…

+197 weitere

Referenzen (5)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan