A cryptograhic flaw exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. A weak cryptograhic mechanism is used to generate the intialization vector in multiple security relevant contexts.
| Package (Ecosystem) | Introduced | Fixed | Limit |
|---|---|---|---|
| magento/community-edition(Packagist) | 2.1 | 2.1.18 | N/A |
| magento/community-edition(Packagist) | 2.2 | 2.2.9 | N/A |
| magento/community-edition(Packagist) | 2.3 | 2.3.2 | N/A |
CVSS Metrics
