GitHub Advisoryadvisory · Packagist

GHSA-7h8v-f2g9-39fx Magento 2 Community Edition Cryptographic Flaw

HIGH Published 2022-05-24 Modified 2024-02-12 Official page ↗
Aliases
CVE-2019-7858
Ecosystem
Packagist
Packages
magento/community-edition
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-327
Reviewed
2023-07-17

Affected packages

• Packagist magento/community-edition: >= 2.1.0, < 2.1.18 → fixed in 2.1.18 • Packagist magento/community-edition: >= 2.2.0, < 2.2.9 → fixed in 2.2.9 • Packagist magento/community-edition: >= 2.3.0, < 2.3.2 → fixed in 2.3.2

Description

A cryptographic flaw in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9 and Magento 2.3 prior to 2.3.2 resulted in storage of sensitive information with an algorithm that is insufficiently resistant to brute force attacks.

Related

Alias · CVE (1)

  • CVE-2019-7858 A cryptographic flaw in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9 and Magento 2.3 prior to 2.3.2 resulted in storage of… vulnerability

Weakness · CWE (1)

  • CWE-327 Use of a Broken or Risky Cryptographic Algorithm weakness

References