CVE-2019-7855 — Use of Cryptographically Weak Pseudo-Random Number Generator in Magento

CWE-338 — Use of Cryptographically Weak Pseudo-Random Number Generator4 documents4 sources

Severity

5.3MEDIUMNVD

EPSS

0.2%

top 57.84%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Magento Magento Community-edition Adobe Systems Incorporated Magento 2

Timeline

PublishedAug 2

Latest updateMay 24

Description

A cryptograhic flaw in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 could be abused by an unauthenticated user to discover an invariant used in gift card generation.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NExploitability: 3.9 | Impact: 1.4

Affected Packages3 packages

▶NVDmagento/magento2.1.0 — 2.1.18+2

▶Packagistmagento/community-edition2.1.0 — 2.1.18+2

▶CVEListV5adobe_systems_incorporated/magento_2Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2

🔴Vulnerability Details

GHSA

Magento 2 Community Cryptographic Flaw↗2022-05-24

▶

OSV

Magento 2 Community Cryptographic Flaw↗2022-05-24

▶

CVEList

CVE-2019-7855: A cryptograhic flaw in Magento 2↗2019-08-02

▶