GitHub Advisoryadvisory · Packagist
GHSA-2w26-gmqm-mc5p Magento 2 Community Cryptographic Flaw
MEDIUM
Official page ↗
- Aliases
- CVE-2019-7855
- Ecosystem
- Packagist
- Packages
- magento/community-edition
- Severity
- Moderate
- CVSS vector
- CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- Weaknesses
- CWE-338
- Reviewed
- 2023-07-17
Affected packages
• Packagist magento/community-edition: >= 2.1.0, < 2.1.18 → fixed in 2.1.18
• Packagist magento/community-edition: >= 2.2.0, < 2.2.9 → fixed in 2.2.9
• Packagist magento/community-edition: >= 2.3.0, < 2.3.2 → fixed in 2.3.2
Description
A cryptograhic flaw in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 could be abused by an unauthenticated user to discover an invariant used in gift card generation.
Related
Alias · CVE (1)
- CVE-2019-7855 A cryptograhic flaw in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 could be abused by an… vulnerability
Weakness · CWE (1)
- CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) weakness
References
- https://nvd.nist.gov/vuln/detail/CVE-2019-7855 advisory
- https://github.com/FriendsOfPHP/security-advisories/blob/master/magento/product-community-edition/CVE-2019-7855.yaml web
- https://github.com/magento/magento2 package
- https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23 web
- https://web.archive.org/web/20220121051916/https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23 web