Vulnerability advisory

CVE-2018-5301

Published Jan 8, 2018Updated Oct 24, 2026OSV record ↗

Severity

CVSS 3.xCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Affected versions

Repository

Affected commits	Fixed by commit
GIT github.com/magento/devdocs ↗
All commits before 18b0d2797739f36ebb8740e8a8a80946839b7139	`18b0d2797739f36ebb8740e8a8a80946839b7139`
60523b1194f96e18c94c82b5515b0274b30e2151 to before 18b0d2797739f36ebb8740e8a8a80946839b7139	`18b0d2797739f36ebb8740e8a8a80946839b7139`
Also listed as affected (3) `2.1.1` `2.0.9` `2.0.8`
GIT github.com/magento/magento2 ↗
All commits before 60fcebc2b5209fd2bde35be3b0bc796a0dd56f37	`60fcebc2b5209fd2bde35be3b0bc796a0dd56f37`
909a2d7e8c2ac5ca55359827c22cea93fdb719df to before 4e3a2ab64ae51198eb27afb077465df6fb02733a	`4e3a2ab64ae51198eb27afb077465df6fb02733a`
Also listed as affected (36) `2.0.9` `2.1.1` `2.0.8` `2.0.7` `2.1.0` `2.0.6` `2.0.5` `2.0.4` `2.0.3` `2.0.2` `2.0.1` `2.0.0` `2.0.0-rc` `0.74.0-beta1` `0.42.0-beta3` `0.1.0-alpha108` `0.42.0-beta1` `0.1.0-alpha107` `0.1.0-alpha106` `0.1.0-alpha105` `0.1.0-alpha104` `0.1.0-alpha103` `0.1.0-alpha102` `0.1.0-alpha101` `0.1.0-alpha100` `0.1.0-alpha99` `0.1.0-alpha98` `0.1.0-alpha97` `0.1.0-alpha96` `0.1.0-alpha95` `0.1.0-alpha94` `0.1.0-alpha93` `0.1.0-alpha92` `0.1.0-alpha91` `0.1.0-alpha90` `0.1.0-alpha89`

Description

Magento Community Edition and Enterprise Edition before 2.0.10 and 2.1.x before 2.1.2 have CSRF resulting in deletion of a customer address from an address book, aka APPSEC-1433.

References

Fixmagento.com/security/patches/magento-2010-and-212-security-update ↗