Medium
Security advisory
An information disclosure vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with privileges to create email templates could leak sensitive data via a malicious email template.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2019-7888
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 05:19 UTC · Revision 1
Source evidence
An information disclosure vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with privileges to create email templates could leak sensitive data via a malicious email template.
osv:CVE-2019-7888
Complete source record
{
"id": "b45d510af358f8ca8834d1769a9d1c36eabf035cc091be1bbbd22990b198ad63",
"url": "https://osv.dev/vulnerability/CVE-2019-7888",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2019-7888",
"summary": "An information disclosure vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with privileges to create email templates could leak sensitive data via a malicious email template.",
"evidence": "osv:CVE-2019-7888",
"products": [],
"severity": "medium",
"structured": {
"id": "CVE-2019-7888",
"aliases": [
"CVE-2019-7888",
"GHSA-9pgc-rvp9-rqv3"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/magento/devdocs",
"type": "GIT",
"events": [
{
"introduced": "60523b1194f96e18c94c82b5515b0274b30e2151"
},
{
"fixed": "452b21aa6d3a221b587ca32d2d50785d92dd6aa1"
},
{
"introduced": "239bfc72e116f6814ff6c2f6731f0830f3bcf61c"
},
{
"fixed": "452b21aa6d3a221b587ca32d2d50785d92dd6aa1"
},
{
"introduced": "75da24b3b0fb950648d00e7454dae0bb7da64c30"
},
{
"fixed": "452b21aa6d3a221b587ca32d2d50785d92dd6aa1"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:magento:magento:*:*:*:*:open_source:*:*:*",
"range": [
{
"introduced": "2.1.0"
},
{
"fixed": "2.1.18"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:magento:magento:*:*:*:*:open_source:*:*:*",
"range": [
{
"introduced": "2.2.0"
},
{
"fixed": "2.2.9"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:magento:magento:*:*:*:*:open_source:*:*:*",
"range": [
{
"introduced": "2.3.0"
},
{
"fixed": "2.3.2"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"2.3.0",
"2.2.7",
"2.1.16",
"2.3.1",
"2.2.8",
"2.1.17"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-7888.json"
}
},
{
"ranges": [
{
"repo": "https://github.com/magento/magento2",
"type": "GIT",
"events": [
{
"introduced": "909a2d7e8c2ac5ca55359827c22cea93fdb719df"
},
{
"fixed": "b808e00f4ad6fb33d5622171a88eb68877ae318d"
},
{
"introduced": "07465f8ce879ff0bd0ba72a662c9e2473e49afe4"
},
{
"fixed": "0a1a283cd6a0cf4b98a051867f90150c9490fcec"
},
{
"introduced": "f4c1d7526f05bdfb1327b0701cc345f94aadcaed"
},
{
"fixed": "ddf42caaf25311f10b23b95a92746f99943e045e"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:magento:magento:*:*:*:*:open_source:*:*:*",
"range": [
{
"introduced": "2.1.0"
},
{
"fixed": "2.1.18"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:magento:magento:*:*:*:*:open_source:*:*:*",
"range": [
{
"introduced": "2.2.0"
},
{
"fixed": "2.2.9"
}
],
"source": "CPE_RANGE"
},
{
"cpe": "cpe:2.3:a:magento:magento:*:*:*:*:open_source:*:*:*",
"range": [
{
"introduced": "2.3.0"
},
{
"fixed": "2.3.2"
}
],
"source": "CPE_RANGE"
}
]
}
}
],
"versions": [
"2.3.1",
"2.3.0",
"2.2.0-rc2.2",
"2.2.0-rc2.3",
"2.2.0-rc2.1",
"2.2.0-rc2.0",
"2.2.0-RC1.8",
"2.2.0-RC1.6",
"2.2.0-RC1.3",
"2.2.0-RC1.5",
"2.2.0-RC1.4",
"2.2.0-RC1.2",
"2.1.5",
"2.2.0-RC1.1",
"2.1.6",
"2.1.4",
"2.1.2",
"2.1.1",
"2.1.0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2019-7888.json"
}
}
],
"modified": "2026-10-24T10:30:27.094478074Z",
"provider": "osv",
"references": [
"https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-33"
],
"provider_metadata": {}
},
"related_cves": [
{
"value": "CVE-2019-7888",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 431755,
"published_at": "2019-08-02T22:15:16.783+00:00"
}