PT-2019-18797 · Adobe · Magento

Published 2019-08-02 · Updated 2022-05-24 · CVE-2019-7873

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions Magento 2.1 versions prior to 2.1.18 Magento 2.2 versions prior to 2.2.9 Magento 2.3 versions prior to 2.3.2

Description A cross-site request forgery issue exists, potentially leading to the unintended deletion of the store design schedule.

Recommendations For Magento 2.1 versions prior to 2.1.18, update to version 2.1.18 or later. For Magento 2.2 versions prior to 2.2.9, update to version 2.2.9 or later. For Magento 2.3 versions prior to 2.3.2, update to version 2.3.2 or later.

Exploit

Fix

XSS

CSRF

Weakness Enumeration

CWE-79

CWE-352

Related Identifiers

CVE-2019-7873

GHSA-8578-MMF4-F327

Affected Products

Magento

References · 7

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/magento/product-community-edition/CVE-2019-7873.yaml · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-7873 · Security Note
• https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-33 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2019-7873 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8578-mmf4-f327 · Vendor Advisory
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-7873 · Note
• https://web.archive.org/web/20220121011306/https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-33 · Note