Use Of Insufficiently Random Values

Magento LTS is vulnerable to Use of Insufficiently Random Values. The vulnerability is caused by not generating sufficient length protect_code value as part of guest order cookie - guest-view and not implementing a rate limiting in the end point (e.g: /magento19/index.php/default/sales/guest/view/) which is used to access the sensitive guest data order using this cookie. An attacker can brute-force the protect_code for guest orders very easily as it is 6 digits hexadecimal value and can result in disclosure of sensitive information like billing address, shipping address, payment details and the ordered items.