GitHub Advisoryadvisory · Packagist

GHSA-x5q5-6wvf-2fpq Magento 2 Community Edition Insufficient Logging

MEDIUM Published 2022-05-24 Modified 2023-09-26 Official page ↗
Aliases
CVE-2019-8124
Ecosystem
Packagist
Packages
magento/community-edition
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
Weaknesses
CWE-345
Reviewed
2023-07-18

Affected packages

• Packagist magento/community-edition: >= 2.1.0, < 2.1.19 → fixed in 2.1.19 • Packagist magento/community-edition: >= 2.2.0, < 2.2.10 → fixed in 2.2.10 • Packagist magento/community-edition: >= 2.3.0, < 2.3.3 → fixed in 2.3.3

Description

An insufficient logging and monitoring vulnerability exists in Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3. Failure to track admin actions related to design configuration could lead to repudiation attacks.

Related

Alias · CVE (1)

  • CVE-2019-8124 An insufficient logging and monitoring vulnerability exists in Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior… vulnerability

Weakness · CWE (1)

  • CWE-345 Insufficient Verification of Data Authenticity weakness

References