PT-2019-18892 · Adobe · Magento

Publicado 2019-11-05 · Atualizado 2020-08-24 · CVE-2019-8116

Positive Technologies (AI Summary)

CVSS v3.1

7.5

Alta

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Magento 2.2 prior to 2.2.10 Magento 2.3 prior to 2.3.3 or 2.3.2-p1

Description The issue is related to insecure authentication and session management. An unauthenticated user can exploit a guest session id value following a successful login to gain access to the customer account index page.

Recommendations For Magento 2.2 prior to 2.2.10, update to version 2.2.10 or later. For Magento 2.3 prior to 2.3.3 or 2.3.2-p1, update to version 2.3.3 or 2.3.2-p1 or later.

Correção

Session Fixation

Enumeração de Fraquezas

CWE-384

Identificadores relacionados

CVE-2019-8116

Produtos afetados

Magento

Referências · 4

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-8116 · Nota
• https://osv.dev/vulnerability/CVE-2019-8116 · Aviso do Fabricante
• https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2019-8116 · Nota de Segurança