GitHub Advisoryadvisory · Packagist
GHSA-prw8-gqwp-f7fh Magento 2 Community Edition DoS vulnerability
HIGH
Official page ↗
- Aliases
- CVE-2019-7915
- Ecosystem
- Packagist
- Packages
- magento/community-edition
- Severity
- High
- CVSS vector
- CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- Reviewed
- 2023-07-14
Affected packages
• Packagist magento/community-edition: >= 2.1.0, < 2.1.18 → fixed in 2.1.18
• Packagist magento/community-edition: >= 2.2.0, < 2.2.9 → fixed in 2.2.9
• Packagist magento/community-edition: >= 2.3.0, < 2.3.2 → fixed in 2.3.2
Description
A denial-of-service vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. Under certain conditions, an unauthenticated attacker could force the Magento store's full page cache to serve a 404 page to customers.
Related
Alias · CVE (1)
- CVE-2019-7915 A denial-of-service vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. vulnerability
References
- https://nvd.nist.gov/vuln/detail/CVE-2019-7915 advisory
- https://github.com/FriendsOfPHP/security-advisories/blob/master/magento/product-community-edition/CVE-2019-7915.yaml web
- https://github.com/magento/magento2 package
- https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13 web
- https://web.archive.org/web/20211206084839/https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13 web