PT-2016-5068 · Magento · Magento Community Edition+1

Egidio Romano · Published 2016-04-15 · Updated 2018-10-09 · CVE-2016-2212

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Magento Enterprise Edition versions prior to 1.14.2.3 Magento Community Edition versions prior to 1.9.2.3

Description The issue allows remote attackers to obtain sensitive order information. This is achieved by exploiting the getOrderByStatusUrlKey function in the Mage Rss Helper Order class. The exploitation occurs through the order id in a JSON object in the data parameter in an RSS feed request to the "index.php/rss/order/status" endpoint.

Recommendations For Magento Enterprise Edition versions prior to 1.14.2.3, update to version 1.14.2.3 or later. For Magento Community Edition versions prior to 1.9.2.3, update to version 1.9.2.3 or later.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2016-2212

Affected Products

Magento Community Edition

Magento Enterprise Edition

References · 7

• 🔥 http://karmainsecurity.com/KIS-2016-02 · Exploit
• 🔥 http://packetstormsecurity.com/files/135941/Magento-1.9.2.2-RSS-Feed-Information-Disclosure.html · Exploit
• https://osv.dev/vulnerability/CVE-2016-2212 · Vendor Advisory
• https://magento.com/security/patches/supee-7405 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-2212 · Security Note
• http://securityfocus.com/archive/1/537601/100/0/threaded · Note
• http://seclists.org/fulldisclosure/2016/Feb/105 · Note