DemoBook a demo

Vulnerability advisory

CVE-2023-41879

Magento LTS's guest order "protect code" can be brute-forced too easily

Published Updated OSV record ↗

Also known as GHSA-9358-cpvx-c2qp

Severity
  • CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected versions

Repository

Affected commitsFixed by commit
GIT github.com/openmage/magento-lts ↗
All commits before 797d2a077cf5fb335faeedf79c273bacca5879d8797d2a077cf5fb335faeedf79c273bacca5879d8
16c8e84ddaf5d54eef1e025a241bdd5f9a60bd6f to before 0f032f375598b50d1c9c553206a9c750796bf1d60f032f375598b50d1c9c553206a9c750796bf1d6
Not specified2a2a2fb504247e8966f8ffc2e17d614be5d43128
Not specified31e74ac5d670b10001f88f038046b62367f15877
Also listed as affected (106)
  • v19.5.0
  • v20.1.0
  • v20.1.0-rc7
  • v20.1.0-rc6
  • v19.5.0-rc5
  • v20.1.0-rc5
  • v19.5.0-rc4
  • v20.1.0-rc4
  • v19.5.0-rc3
  • v20.1.0-rc3
  • v20.1.0-rc2
  • v19.5.0-rc2
  • v20.1.0-rc1
  • v19.5.0-rc1
  • v20.0.18
  • v19.4.20
  • v20.0.17
  • v19.4.19
  • v20.0.16
  • v19.4.18
  • v20.0.15
  • v19.4.16
  • v20.0.13
  • v19.4.15
  • v20.0.12
  • v20.0.11
  • v19.4.14
  • v20.0.10
  • v19.4.13
  • v20.0.8
  • v19.4.12
  • v20.0.7
  • v19.4.11
  • v20.0.6
  • v19.4.10
  • v20.0.5
  • v19.4.9
  • v20.0.4
  • v19.4.8
  • v20.0.3
  • v19.4.7
  • v20.0.2
  • v19.4.6
  • v20.0.1
  • v19.4.5
  • v20.0.0
  • v19.4.4
  • v19.4.3
  • v19.4.2
  • v19.4.1
  • v19.4.0
  • 1.9.0.1
  • 1.9.1.1
  • 1.9.1.0-lts
  • 1.9.0.0
  • 1.8.1.0
  • 1.7.0.2
  • 1.7.0.1
  • 1.7.0.0
  • 1.6.1.0
  • 1.6.0.0
  • 1.6.0.0-rc2
  • 1.6.0.0-rc1
  • 1.6.0.0-beta1
  • 1.6.0.0-alpha1
  • 1.5.1.0
  • 1.5.0.1
  • 1.5.0.0
  • 1.5.0.0-rc2
  • 1.5.0.0-rc1
  • 1.5.0.0-beta2
  • 1.5.0.0-beta1
  • 1.5.0.0-alpha2
  • 1.5.0.0-alpha1
  • 1.4.2.0
  • 1.4.1.1
  • 1.4.1.0
  • 1.4.0.1
  • 1.3.2.4
  • 1.4.0.0
  • 1.4.0.0-rc1
  • 1.4.0.0-beta1
  • 1.4.0.0-alpha3
  • 1.4.0.0-alpha2
  • 1.4.0.0-alpha1
  • 1.3.2.3
  • 1.3.2.2
  • 1.3.2.1
  • 1.3.2
  • 1.3.1.1
  • 1.3.1
  • 1.3.0
  • 1.2.1.2
  • 1.2.1
  • 1.2.0.3
  • 1.2.0.2
  • 1.2.0.1
  • 1.2.0
  • 1.1.8
  • 1.1.7
  • 1.1.6
  • 1.1.5
  • 1.1.4
  • 1.1.3
  • 1.1.2
  • 1.1.1

Description

Magento LTS is the official OpenMage LTS codebase. Guest orders may be viewed without authentication using a "guest-view" cookie which contains the order's "protect_code". This code is 6 hexadecimal characters which is arguably not enough to prevent a brute-force attack. Exposing each order would require a separate brute force attack. This issue has been patched in versions 19.5.1 and 20.1.1.

References

  • Codex
  • Claude Code
  • VS Code
  • GitHub Copilot
  • Cursor
  • Cline
  • Windsurf
  • Google Anti-gravity
  • OpenCode
  • Pi
  • Gemini CLI
  • Hermes Agent
  • Zed
  • Junie
  • Qwen Code
  • Kiro
  • Kilo Code
  • Factory Droid

Set up GitHits for your agents

Run this command:

<> bash
npx githits@latest init

What happens next:

  1. Opens your browser to authorize GitHits
  2. Asks whether to set up GitHits at the user or project level
  3. Detects your supported AI coding tools
  4. Lets you choose which tools to configure
  5. Configures the selected tools

Having trouble? Check our documentation.