CVE-2019-7865 — Cross-Site Request Forgery in Magento

CWE-352 — Cross-Site Request Forgery4 documents4 sources
Severity
8.8HIGHNVD
EPSS
0.1%
top 81.46%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
MagentoMagento Community-editionMagento Product-community-edition+1 more
Timeline
PublishedAug 2
Latest updateMay 24

Description

A cross-site request forgery (CSRF) vulnerability exists in the checkout cart item of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited at the time of editing or configuration.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages4 packages

▶NVDmagento/magento2.1.0 — 2.1.18+2
▶Packagistmagento/community-edition2.1.0 — 2.1.18+2
▶Packagistmagento/product-community-edition2.1 — 2.1.18+2
▶CVEListV5adobe_systems_incorporated/magento_2Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2

🔴Vulnerability Details

3
OSV
Magento 2 Community Edition CSRF Vulnerability↗2022-05-24
▶
GHSA
Magento 2 Community Edition CSRF Vulnerability↗2022-05-24
▶
CVEList
CVE-2019-7865: A cross-site request forgery (CSRF) vulnerability exists in the checkout cart item of Magento 2↗2019-08-02
▶
CVE-2019-7865 — Cross-Site Request Forgery in Magento | cvebase