GHSA-8578-mmf4-f327
Magento 2 Community Edition Cross-site Scripting Vulnerability
En bref
- Publiée
- Mise à jour
- CVE
- CVE-2019-7873
- CVSS_V3
- CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Description
A cross-site request forgery vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can result in unintended deletion of the store design schedule.
Paquets affectés
| Paquet | Versions |
|---|---|
| Packagist · magento/community-edition | introduced 2.1.0, fixed 2.1.18 |
| Packagist · magento/community-edition | introduced 2.2.0, fixed 2.2.9 |
| Packagist · magento/community-edition | introduced 2.3.0, fixed 2.3.2 |
Références
- https://nvd.nist.gov/vuln/detail/CVE-2019-7873 ADVISORY
- https://github.com/FriendsOfPHP/security-advisories/blob/master/magento/product-community-edition/CVE-2019-7873.yaml WEB
- https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-33 WEB
- https://web.archive.org/web/20220121011306/https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-33 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |