Moole Vulnerability Database

Find real vulnerabilities before they ship

Medium

CVE-2019-7874

A cross-site request forgery vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can result in unintended deletion of user roles.

VectorNETWORK

PublishedAug 02, 2019, 22:15

Published Bypsirt@adobe.com

Base Score

Score6.5

Affected Versions

Package (Ecosystem)IntroducedFixedLimit

magento/community-edition(Packagist)2.1.02.1.18N/A

magento/community-edition(Packagist)2.2.02.2.9N/A

magento/community-edition(Packagist)2.3.02.3.2N/A

References

https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13

Weakness Type

CWE-352

CVSS Metrics

Base Score

6.5

Vector String

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Base SeverityMedium

Version

3.0

Attack Vector (AV)

NETWORK