CVE-2023-41879 Magento LTS's guest order "protect code" can be brute-forced too easily

2023-09-1121:14:28

CWE-330

GitHub_M

www.cve.org

magento lts

guest order

protect code

vulnerability

7.5 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

0.001 Low

EPSS

Percentile

25.8%

JSON

Magento LTS is the official OpenMage LTS codebase. Guest orders may be viewed without authentication using a “guest-view” cookie which contains the order’s “protect_code”. This code is 6 hexadecimal characters which is arguably not enough to prevent a brute-force attack. Exposing each order would require a separate brute force attack. This issue has been patched in versions 19.5.1 and 20.1.1.

CNA Affected

[
  {
    "vendor": "OpenMage",
    "product": "magento-lts",
    "versions": [
      {
        "version": "<= 19.5.0",
        "status": "affected"
      },
      {
        "version": ">= 20.0.0, <= 20.1.0",
        "status": "affected"
      }
    ]
  }
]