CVEvulnerability

CVE-2019-7852

5.3 MEDIUM Published 2019-08-02 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2019-08-02
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
5.3 MEDIUM — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS 2.0 ([email protected])
5.0 MEDIUM — AV:N/AC:L/Au:N/C:P/I:N/A:N
Weaknesses
CWE-200

Description

A path disclosure vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. Requests for a specific file path could result in a redirect to the URL of the Magento admin panel, disclosing its location to potentially unauthorized parties.

Affected configurations

• magento magento (>= 2.1.0 < 2.1.18) • magento magento (>= 2.2.0 < 2.2.9) • magento magento (>= 2.3.0 < 2.3.2)

Related

Weakness · CWE (1)

  • CWE-200 Exposure of Sensitive Information to an Unauthorized Actor weakness

References