PT-2018-3749 · Adobe · Campaign Classic+1

Published 2018-07-18 · Updated 2022-05-24 · CVE-2019-7849

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Magento 1.x versions prior to 1.9.4.2 Magento Commerce versions prior to 1.14.4.2 Magento 2.1 versions prior to 2.1.18 Magento 2.2 versions prior to 2.2.9 Magento 2.3 versions prior to 2.3.2 Adobe Campaign Classic (affected versions not specified)

Description The issue is related to inadequate session validation handling, which can be exploited by a remote attacker to impact data integrity. A defense-in-depth check was added to mitigate this issue in certain versions of Magento.

Recommendations For Magento 1.x versions prior to 1.9.4.2, update to version 1.9.4.2 or later. For Magento Commerce versions prior to 1.14.4.2, update to version 1.14.4.2 or later. For Magento 2.1 versions prior to 2.1.18, update to version 2.1.18 or later. For Magento 2.2 versions prior to 2.2.9, update to version 2.2.9 or later. For Magento 2.3 versions prior to 2.3.2, update to version 2.3.2 or later. At the moment, there is no information about a newer version that contains a fix for Adobe Campaign Classic.

Exploit

Fix

Session Fixation

Weakness Enumeration

CWE-384

Related Identifiers

BDU:2021-04250

CVE-2019-7849

GHSA-V797-HFV8-V2XM

Affected Products

Campaign Classic

Magento

References · 11

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/magento/product-community-edition/CVE-2019-7849.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/magento/magento1ce/CVE-2019-7849.yaml · Exploit
• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/magento/magento1ee/CVE-2019-7849.yaml · Exploit
• https://osv.dev/vulnerability/CVE-2019-7849 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-v797-hfv8-v2xm · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-7849 · Security Note
• https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-33 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-04250 · Security Note
• https://helpx.adobe.com/security/products/campaign/apsb19-28.html · Note
• https://web.archive.org/web/20220121011306/https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-33 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-7849 · Note