CVE-2019-7892

CVE-2019-7892 is a remote code execution vulnerability affecting Magento 2.1 (prior to 2.1.18), 2.2 (prior to 2.2.9), and 2.3 (prior to 2.3.2). An authenticated administrator can exploit this flaw through server-side request forgery within shipment settings to execute arbitrary code. Rated as high severity with a CVSS score of 7.2, it requires high privileges but has low attack complexity, potentially leading to full compromise of confidentiality, integrity, and availability. There is no evidence of active exploitation, public exploit code, or significant community discussion surrounding this vulnerability.