PT-2019-18888 · Adobe · Magento

Published 2019-11-05 · Updated 2022-05-24 · CVE-2019-8112

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Magento 2.2 versions prior to 2.2.10 Magento 2.3 versions prior to 2.3.3 or 2.3.2-p1

Description A security bypass issue exists, allowing an unauthenticated user to bypass the email confirmation mechanism. This is achieved via a GET request that captures relevant account data obtained from the POST response related to new user creation.

Recommendations For Magento 2.2 versions prior to 2.2.10, update to version 2.2.10 or later. For Magento 2.3 versions prior to 2.3.3, update to version 2.3.3 or later. For Magento 2.3 version 2.3.2, apply patch 2.3.2-p1 or later.

Exploit

Fix

Insufficient Verification of Data Authenticity

Weakness Enumeration

CWE-345

Related Identifiers

CVE-2019-8112

GHSA-P9VF-4JX2-5HPP

Affected Products

Magento

References · 8

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/magento/product-community-edition/CVE-2019-8112.yaml · Exploit
• https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-8112 · Security Note
• https://osv.dev/vulnerability/CVE-2019-8112 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-p9vf-4jx2-5hpp · Vendor Advisory
• https://github.com/magento/magento2 · Note
• https://web.archive.org/web/20220121051105/https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-8112 · Note