GHSA-w392-68rg-pgg4
Magento 2 Community Edition CSRF vulnerability
En bref
- Publiée
- Mise à jour
- CVE
- CVE-2019-7947
- CVSS_V3
- CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Description
A cross-site request forgery vulnerability exists in the GiftCardAccount removal feature for Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2.
Paquets affectés
| Paquet | Versions |
|---|---|
| Packagist · magento/community-edition | introduced 2.1.0, fixed 2.1.18 |
| Packagist · magento/community-edition | introduced 2.2.0, fixed 2.2.9 |
| Packagist · magento/community-edition | introduced 2.3.0, fixed 2.3.2 |
Références
- https://nvd.nist.gov/vuln/detail/CVE-2019-7947 ADVISORY
- https://github.com/FriendsOfPHP/security-advisories/blob/master/magento/magento1ce/CVE-2019-7947.yaml WEB
- https://github.com/FriendsOfPHP/security-advisories/blob/master/magento/magento1ee/CVE-2019-7947.yaml WEB
- https://github.com/FriendsOfPHP/security-advisories/blob/master/magento/product-community-edition/CVE-2019-7947.yaml WEB
- https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-33 WEB
- https://web.archive.org/web/20220121011306/https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-33 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |