Lucene search

GitHub Advisory DatabaseGHSA-W3MQ-67MW-3P9F

HistoryMay 14, 2022 - 3:46 a.m.

Magento Cross-Site Request Forgery (CSRF)

2022-05-1403:46:39

CWE-352

GitHub Advisory Database

github.com

5.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:P/A:P

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

7.2 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

27.9%

JSON

Magento Community Edition and Enterprise Edition before 2.0.10 and 2.1.x before 2.1.2 have CSRF resulting in deletion of a customer address from an address book, aka APPSEC-1433.

Affected configurations

Vulners

Node

magentomagentoRange<2.1.2community

magentomagentoRange<2.0.10community

CPENameOperatorVersion
magento/community-editionlt2.1.2
magento/community-editionlt2.0.10

CPE	Name	Operator	Version
	magento/community-edition	lt	2.1.2
	magento/community-edition	lt	2.0.10

References

github.com/advisories/GHSA-w3mq-67mw-3p9f

magento.com/security/patches/magento-2010-and-212-security-update

nvd.nist.gov/vuln/detail/CVE-2018-5301

5.8 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:N/I:P/A:P

6.5 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

HIGH

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

7.2 High

AI Score

Confidence

Low

0.001 Low

EPSS

Percentile

27.9%

JSON

Related for GHSA-W3MQ-67MW-3P9F