Vulnerability advisory
GHSA-274w-2j5w-m2xj
Magento 2 Community Edition Information Disclosure
Also known as CVE-2019-7899
Severity
- CVSS 3.x
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Affected versions
| Affected | Fixed in |
|---|---|
2.1.0 to before 2.1.18 | 2.1.18Advisories → |
2.2.0 to before 2.2.9 | 2.2.9Advisories → |
2.3.0 to before 2.3.2 | 2.3.2Advisories → |
Description
Names of disabled downloadable products could be disclosed due to inadequate validation of user input in Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2.
References
- Advisorynvd.nist.gov/vuln/detail/CVE-2019-7899 ↗
- Webgithub.com/FriendsOfPHP/security-advisories/blob/master/magento/magento1ce/CVE-2019-7899.yaml ↗
- Webgithub.com/FriendsOfPHP/security-advisories/blob/master/magento/magento1ee/CVE-2019-7899.yaml ↗
- Webgithub.com/FriendsOfPHP/security-advisories/blob/master/magento/product-community-edition/CVE-2019-7899.yaml ↗
- Packagegithub.com/magento/magento2 ↗
- Webmagento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-33 ↗
- Webweb.archive.org/web/20220121011306/https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-33 ↗