Vulnerability advisory

GHSA-hmch-9947-82rj

Magento 2 Community Edition Weak Cryptography

Published May 24, 2022Updated Feb 16, 2024OSV record ↗

Also known as CVE-2019-8118

Severity

CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Affected versions

magento/community-edition Packagist

All magento/community-edition advisories →

Affected	Fixed in
`2.1.0` to before 2.1.19	`2.1.19`Advisories →
Also listed as affected (19) `2.1.0` `2.1.1` `2.1.10` `2.1.11` `2.1.12` `2.1.13` `2.1.14` `2.1.15` `2.1.16` `2.1.17` `2.1.18` `2.1.2` `2.1.3` `2.1.4` `2.1.5` `2.1.6` `2.1.7` `2.1.8` `2.1.9`
`2.2.0` to before 2.2.10	`2.2.10`Advisories →
Also listed as affected (10) `2.2.0` `2.2.1` `2.2.2` `2.2.3` `2.2.4` `2.2.5` `2.2.6` `2.2.7` `2.2.8` `2.2.9`
`2.3.0` to before 2.3.3	`2.3.3`Advisories →
Also listed as affected (4) `2.3.0` `2.3.1` `2.3.2` `2.3.2-p2`

Description

Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 uses weak cryptographic function to store the failed login attempts for customer accounts.

GHSA-hmch-9947-82rj

Affected versions

magento/community-edition Packagist

Description

References