Lucene search

GitHub Advisory DatabaseGHSA-89CH-HQF9-RGP3

HistoryNov 12, 2019 - 10:59 p.m.

Using JS libraries with known security vulnerabilities

2019-11-1222:59:28

GitHub Advisory Database

github.com

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

0.002 Low

EPSS

Percentile

56.0%

JSON

An insecure component vulnerability exists in Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3. Magento 2 codebase leveraged outdated versions of JS libraries (Bootstrap, jquery, Knockout) with known security vulnerabilities.

Affected configurations

Vulners

Node

magentomagentoRange<2.3.2-p2community

magentomagentoRange<2.2.10community

magentomagentoRange<2.3.3community

magentomagentoRange<2.2.10community

CPENameOperatorVersion
magento/product-community-editionlt2.3.2-p2
magento/product-community-editionlt2.2.10
magento/community-editionlt2.3.3
magento/community-editionlt2.2.10

Name	Operator	Version
magento/product-community-edition	lt	2.3.2-p2
magento/product-community-edition	lt	2.2.10
magento/community-edition	lt	2.3.3
magento/community-edition	lt	2.2.10

References

github.com/advisories/GHSA-89ch-hqf9-rgp3

github.com/FriendsOfPHP/security-advisories/blob/master/magento/product-community-edition/CVE-2019-8121.yaml

magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update

nvd.nist.gov/vuln/detail/CVE-2019-8121

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

0.002 Low

EPSS

Percentile

56.0%

JSON

Related for GHSA-89CH-HQF9-RGP3