CVE-2019-7139
Magento 2 Community Edition SQLi Vulnerability
Summary
Remediation
Upgrade to the fixed version using your package manager.
composer require "magento/community-edition:^2.2.9"
composer require "magento/community-edition:^2.3.2"
composer require "magento/community-edition:^2.1.18"
After upgrading, run your dependency scanner again to confirm the vulnerability is resolved.
Affected Packages (3)
| Package | Ecosystem | Affected | Fixed In |
|---|---|---|---|
| magento/community-edition | packagist | 2.2.0, 2.2.1, 2.2.2, 2.2.3 (+5 more) | 2.2.9 |
| magento/community-edition | packagist | 2.3.0, 2.3.1 | 2.3.2 |
| magento/community-edition | packagist | 2.1.0, 2.1.1, 2.1.10, 2.1.11 (+14 more) | 2.1.18 |
Vulnerability Classification
Common Weakness Enumeration (CWE) identifiers for this vulnerability type.
- CWE-89SQL InjectionMITRE
CVSS Score Breakdown
What the CVSS (Common Vulnerability Scoring System) 9.8 score means for each attack dimension.
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
- https://nvd.nist.gov/vuln/detail/CVE-2019-7139ADVISORY
- https://github.com/FriendsOfPHP/security-advisories/blob/master/magento/magento1ce/CVE-2019-7139.yamlWEB
- https://github.com/FriendsOfPHP/security-advisories/blob/master/magento/magento1ee/CVE-2019-7139.yamlWEB
- https://github.com/FriendsOfPHP/security-advisories/blob/master/magento/product-community-edition/CVE-2019-7139.yamlWEB
- https://github.com/magento/magento2PACKAGE
- https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13WEB
- https://magento.com/security/patches/supee-11086WEB
- https://web.archive.org/web/20211206084839/https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13WEB
- https://www.ambionics.io/blog/magento-sqliWEB
Frequently Asked Questions
- What is CVE-2019-7139?
- Magento 2 Community Edition SQLi Vulnerability This vulnerability has been assigned a severity rating of CRITICAL (CVSS score: 9.8/10).
- How do I check if my project is affected by CVE-2019-7139?
- CVE-2019-7139 affects magento/community-edition. Use GeekWala's free vulnerability scanner to check your dependencies against CVE-2019-7139 and 200,000+ other known vulnerabilities.
Severity & Exploitability
Exploitation is straightforward and causes maximum impact. Patch immediately.
Also Known As
Related CVEs
- CVE-2022-24086CRITICAL
Magento improper input validation vulnerability
- CVE-2025-24434CRITICAL
Improper Authorization vulnerability in Magento and Adobe Commerce
- CVE-2020-9691CRITICAL
Magento DOM-based Cross-site scripting vulnerability
- CVE-2024-20719HIGH
Magento Open Source allows Cross-Site Scripting (XSS)
- CVE-2025-54264HIGH
Magento vulnerable to stored Cross-Site Scripting (XSS)
- CVE-2025-24414HIGH
Magento Stored Cross-Site Scripting (XSS) Vulnerability
- CVE-2025-24417HIGH
Magento Stored Cross-Site Scripting (XSS) Vulnerability
- CVE-2025-24413HIGH
Magento Stored Cross-Site Scripting (XSS) Vulnerability
Check if you're affected
Scan your dependencies to see if this vulnerability affects your projects.
Scan Your Dependencies