GHSA-f6ww-vqw2-xp3vmedium4.3
Magento Cross-Site Request Forgery (CSRF)
Impact
A cross-site request forgery vulnerability in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 can cause unwanted items to be added to a shopper's cart due to an insufficiently robust anti-CSRF token implementation.
Source excerpt · OSVAffected packages
Start with the recorded fix for your release branch. Check your installed version and test compatibility before upgrading. Fixing this advisory does not rule out other vulnerabilities in the release.
magento/community-edition Packagist
| Affected range | Recorded fix |
|---|---|
| From 2.2.0 before 2.2.9Ecosystem versions | 2.2.9 |
| From 2.1.0 before 2.1.18Ecosystem versions | 2.1.18 |
| From 2.3.0 before 2.3.2Ecosystem versions | 2.3.2 |
Version evidence: OSV · GHSA-f6ww-vqw2-xp3v
View original version evidence (29 explicit versions)
Original source description
A cross-site request forgery vulnerability in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 can cause unwanted items to be added to a shopper's cart due to an insufficiently robust anti-CSRF token implementation.
References
- Security advisory nvd.nist.gov/vuln/detail/CVE-2019-7857
- Security advisory github.com/FriendsOfPHP/security-advisories/blob/master/magento/product-community-edition/CVE-2019-7857.yaml
- Source reference github.com/magento/magento2
- Security advisory magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-33