Medium
Security advisory
An XML entity injection vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated admin user can craft document type definition for an XML representing XML layout. The crafted document type definition and XML layout allow processing of external entities which can lead to information disclosure.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2019-8126
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 06:39 UTC · Revision 1
Source evidence
An XML entity injection vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated admin user can craft document type definition for an XML representing XML layout. The crafted document type definition and XML layout allow processing of external entities which can lead to information disclosure.
osv:CVE-2019-8126
Complete source record
{
"id": "96cad20744532c1dfdda9ecb6117ef87579851734d9b5401d280fd8061fe57b9",
"url": "https://osv.dev/vulnerability/CVE-2019-8126",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2019-8126",
"summary": "An XML entity injection vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated admin user can craft document type definition for an XML representing XML layout. The crafted document type definition and XML layout allow processing of external entities which can lead to information disclosure.",
"evidence": "osv:CVE-2019-8126",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2019-8126",
"aliases": [
"CVE-2019-8126",
"GHSA-427g-2r83-3ccm"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/magento/devdocs",
"type": "GIT",
"events": [
{
"introduced": "239bfc72e116f6814ff6c2f6731f0830f3bcf61c"
},
{
"fixed": "fe462f46d5efe781681fa25067a180b19e0e35de"
},
{
"introduced": "75da24b3b0fb950648d00e7454dae0bb7da64c30"
},
{
"fixed": "452b21aa6d3a221b587ca32d2d50785d92dd6aa1"
},
{
"introduced": "452b21aa6d3a221b587ca32d2d50785d92dd6aa1"
},
{
"last_affected": "452b21aa6d3a221b587ca32d2d50785d92dd6aa1"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:magento:magento:*:*:*:*:commerce:*:*:*",
"range": [
{
"introduced": "2.2.0"
},
{
"fixed": "2.2.10"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:magento:magento:*:*:*:*:open_source:*:*:*",
"range": [
{
"introduced": "2.2.0"
},
{
"fixed": "2.2.10"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:magento:magento:*:*:*:*:commerce:*:*:*",
"range": [
{
"introduced": "2.3.0"
},
{
"fixed": "2.3.2"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:magento:magento:*:*:*:*:open_source:*:*:*",
"range": [
{
"introduced": "2.3.0"
},
{
"fixed": "2.3.2"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:magento:magento:2.3.2:-:*:*:commerce:*:*:*",
"range": [
{
"introduced": "2.3.2-NA"
},
{
"last_affected": "2.3.2-NA"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:magento:magento:2.3.2:-:*:*:open_source:*:*:*",
"range": [
{
"introduced": "2.3.2-NA"
},
{
"last_affected": "2.3.2-NA"
}
],
"source": "CPE_STRING"
}
]
}
}
],
"versions": [
"2.3.2-NA",
"2.3.0",
"2.2.7",
"2.1.16",
"2.3.1",
"2.2.8",
"2.1.17"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-8126.json"
}
},
{
"ranges": [
{
"repo": "https://github.com/magento/magento2",
"type": "GIT",
"events": [
{
"introduced": "07465f8ce879ff0bd0ba72a662c9e2473e49afe4"
},
{
"fixed": "2dd1e1a37a798fd7fd08d6894eb37bcccc99d1c6"
},
{
"introduced": "f4c1d7526f05bdfb1327b0701cc345f94aadcaed"
},
{
"fixed": "ddf42caaf25311f10b23b95a92746f99943e045e"
},
{
"introduced": "ddf42caaf25311f10b23b95a92746f99943e045e"
},
{
"last_affected": "ddf42caaf25311f10b23b95a92746f99943e045e"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:magento:magento:*:*:*:*:commerce:*:*:*",
"range": [
{
"introduced": "2.2.0"
},
{
"fixed": "2.2.10"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:magento:magento:*:*:*:*:open_source:*:*:*",
"range": [
{
"introduced": "2.2.0"
},
{
"fixed": "2.2.10"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:magento:magento:*:*:*:*:commerce:*:*:*",
"range": [
{
"introduced": "2.3.0"
},
{
"fixed": "2.3.2"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:magento:magento:*:*:*:*:open_source:*:*:*",
"range": [
{
"introduced": "2.3.0"
},
{
"fixed": "2.3.2"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:magento:magento:2.3.2:-:*:*:commerce:*:*:*",
"range": [
{
"introduced": "2.3.2-NA"
},
{
"last_affected": "2.3.2-NA"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:magento:magento:2.3.2:-:*:*:open_source:*:*:*",
"range": [
{
"introduced": "2.3.2-NA"
},
{
"last_affected": "2.3.2-NA"
}
],
"source": "CPE_STRING"
}
]
}
}
],
"versions": [
"2.3.2-NA",
"2.3.1",
"2.3.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-8126.json"
}
}
],
"modified": "2026-10-24T10:30:42.536188494Z",
"provider": "osv",
"references": [
"https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update"
],
"provider_metadata": {}
},
"related_cves": [
{
"value": "CVE-2019-8126",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 435409,
"published_at": "2019-11-05T23:15:12.757+00:00"
}