CVE-2019-7947 — Cross-Site Request Forgery in Magento

CWE-352 — Cross-Site Request Forgery4 documents4 sources
Severity
6.5MEDIUMNVD
EPSS
0.0%
top 90.95%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
MagentoMagento Community-edition
Timeline
PublishedAug 2
Latest updateMay 24

Description

A cross-site request forgery vulnerability exists in the GiftCardAccount removal feature for Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages2 packages

▶NVDmagento/magento2.1.0 — 2.1.18+4
▶Packagistmagento/community-edition2.1.0 — 2.1.18+2

🔴Vulnerability Details

3
GHSA
Magento 2 Community Edition CSRF vulnerability↗2022-05-24
▶
OSV
Magento 2 Community Edition CSRF vulnerability↗2022-05-24
▶
CVEList
CVE-2019-7947: A cross-site request forgery vulnerability exists in the GiftCardAccount removal feature for Magento Open Source prior to 1↗2019-08-02
▶
CVE-2019-7947 — Cross-Site Request Forgery in Magento | cvebase