-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability description explicitly mentions a Phar deserialization flaw in the import functionality. The Save controller's execute method is the primary entry point for processing uploaded import files in Magento. Since Phar deserialization is triggered by filesystem operations on untrusted paths, and Magento's import feature would need to interact with uploaded files, this controller is the most likely location where unsafe handling occurs. The high confidence comes from the direct match between the vulnerability's attack vector (authenticated admin using import feature) and Magento's import controller architecture.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| magento/community-edition | composer | >= 2.1.0, < 2.1.19 | 2.1.19 |
| magento/community-edition | composer | >= 2.2.0, < 2.2.10 | 2.2.10 |
| magento/community-edition | composer | >= 2.3.0, < 2.3.3 | 2.3.3 |