GitHub Advisoryadvisory · Packagist

GHSA-w3mq-67mw-3p9f Magento Cross-Site Request Forgery (CSRF)

MEDIUM Published 2022-05-14 Modified 2024-01-11 Official page ↗
Aliases
CVE-2018-5301
Ecosystem
Packagist
Packages
magento/community-edition
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Weaknesses
CWE-352
Reviewed
2024-01-11

Affected packages

• Packagist magento/community-edition: < 2.0.10 → fixed in 2.0.10 • Packagist magento/community-edition: >= 2.1.0, < 2.1.2 → fixed in 2.1.2

Description

Magento Community Edition and Enterprise Edition before 2.0.10 and 2.1.x before 2.1.2 have CSRF resulting in deletion of a customer address from an address book, aka APPSEC-1433.

Related

Alias · CVE (1)

  • CVE-2018-5301 Magento Community Edition and Enterprise Edition before 2.0.10 and 2.1.x before 2.1.2 have CSRF resulting in deletion of a customer address… vulnerability

Weakness · CWE (1)

  • CWE-352 Cross-Site Request Forgery weakness

References