Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
An unauthenticated user can execute SQL statements that allow arbitrary read access to the underlying database, which causes sensitive data leakage. This issue is fixed in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2.
Priority
LOW
Exploitation
NONE
PoC
YES
Patch
NONE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
🔴 CVE-2019-7139 (CVSS 9.8) – Magento için Unauthenticated SQL Injection PoC exploit. Bu eski açık, /catalog/product_frontend_action/synchronize endpoint'i üzerinden kimlik doğrulama olmadan SQL injection gerçekleştirilmesine ve veritabanı bilgilerinin çıkarılmasına olanak sağlıyor. PoC ise, veritabanı/table/column enumeration ve örnek veri çıkarma işlevleri içeriyor. https://github.com/0xSemZ/Magento-CVE-2019-7139-SQLi-PoC
2 of 2 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | magento | magento | - | - | - |
| App | magento | magento | - | - | - |