Vulnerability advisory

GHSA-wmrg-w9vg-7jqx

Magento 2 Community Edition CSRF Vulnerability

Published May 24, 2022Updated Feb 16, 2024OSV record ↗

Also known as CVE-2019-7865

Severity

CVSS 3.xCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected versions

magento/community-edition Packagist

All magento/community-edition advisories →

Affected	Fixed in
`2.1.0` to before 2.1.18	`2.1.18`Advisories →
Also listed as affected (18) `2.1.0` `2.1.1` `2.1.10` `2.1.11` `2.1.12` `2.1.13` `2.1.14` `2.1.15` `2.1.16` `2.1.17` `2.1.2` `2.1.3` `2.1.4` `2.1.5` `2.1.6` `2.1.7` `2.1.8` `2.1.9`
`2.2.0` to before 2.2.9	`2.2.9`Advisories →
Also listed as affected (9) `2.2.0` `2.2.1` `2.2.2` `2.2.3` `2.2.4` `2.2.5` `2.2.6` `2.2.7` `2.2.8`
`2.3.0` to before 2.3.2	`2.3.2`Advisories →
Also listed as affected (2) `2.3.0` `2.3.1`

magento/product-community-edition Packagist

All magento/product-community-edition advisories →

Affected	Fixed in
`2.1` to before 2.1.18	`2.1.18`Advisories →
`2.2` to before 2.2.9	`2.2.9`Advisories →
`2.3` to before 2.3.2	`2.3.2`Advisories →

Description

A cross-site request forgery (CSRF) vulnerability exists in the checkout cart item of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited at the time of editing or configuration.

GHSA-wmrg-w9vg-7jqx

Affected versions

magento/community-edition Packagist

magento/product-community-edition Packagist

Description

References