PT-2019-18892 · Adobe · Magento

Published 2019-11-05 · Updated 2020-08-24 · CVE-2019-8116

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Magento 2.2 prior to 2.2.10 Magento 2.3 prior to 2.3.3 or 2.3.2-p1

Description The issue is related to insecure authentication and session management. An unauthenticated user can exploit a guest session id value following a successful login to gain access to the customer account index page.

Recommendations For Magento 2.2 prior to 2.2.10, update to version 2.2.10 or later. For Magento 2.3 prior to 2.3.3 or 2.3.2-p1, update to version 2.3.3 or 2.3.2-p1 or later.

Fix

Session Fixation

Weakness Enumeration

CWE-384

Related Identifiers

CVE-2019-8116

Affected Products

Magento

References · 4

• https://osv.dev/vulnerability/CVE-2019-8116 · Vendor Advisory
• https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-8116 · Security Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-8116 · Note