mirror of
https://github.com/fkie-cad/nvd-json-data-feeds.git
synced 2025-07-29 05:56:17 +00:00
132 lines
4.3 KiB
JSON
132 lines
4.3 KiB
JSON
{
|
|
"id": "CVE-2019-7947",
|
|
"sourceIdentifier": "psirt@adobe.com",
|
|
"published": "2019-08-02T22:15:19.347",
|
|
"lastModified": "2019-08-09T02:21:40.013",
|
|
"vulnStatus": "Analyzed",
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "A cross-site request forgery vulnerability exists in the GiftCardAccount removal feature for Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2."
|
|
},
|
|
{
|
|
"lang": "es",
|
|
"value": "Se presenta una vulnerabilidad de tipo cross-site request forgery en la funcionalidad de eliminaci\u00f3n de GiftCardAccount para Magento Open Source anterior a versi\u00f3n 1.9.4.2 y Magento Commerce anterior a versi\u00f3n 1.14.4.2, Magento versiones 2.1 anteriores a 2.1.18, Magento versiones 2.2 anteriores a 2.2.9, Magento versiones 2.3 a anteriores a 2.3.2."
|
|
}
|
|
],
|
|
"metrics": {
|
|
"cvssMetricV30": [
|
|
{
|
|
"source": "nvd@nist.gov",
|
|
"type": "Primary",
|
|
"cvssData": {
|
|
"version": "3.0",
|
|
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N",
|
|
"attackVector": "NETWORK",
|
|
"attackComplexity": "LOW",
|
|
"privilegesRequired": "NONE",
|
|
"userInteraction": "REQUIRED",
|
|
"scope": "UNCHANGED",
|
|
"confidentialityImpact": "NONE",
|
|
"integrityImpact": "HIGH",
|
|
"availabilityImpact": "NONE",
|
|
"baseScore": 6.5,
|
|
"baseSeverity": "MEDIUM"
|
|
},
|
|
"exploitabilityScore": 2.8,
|
|
"impactScore": 3.6
|
|
}
|
|
],
|
|
"cvssMetricV2": [
|
|
{
|
|
"source": "nvd@nist.gov",
|
|
"type": "Primary",
|
|
"cvssData": {
|
|
"version": "2.0",
|
|
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
|
|
"accessVector": "NETWORK",
|
|
"accessComplexity": "MEDIUM",
|
|
"authentication": "NONE",
|
|
"confidentialityImpact": "NONE",
|
|
"integrityImpact": "PARTIAL",
|
|
"availabilityImpact": "NONE",
|
|
"baseScore": 4.3
|
|
},
|
|
"baseSeverity": "MEDIUM",
|
|
"exploitabilityScore": 8.6,
|
|
"impactScore": 2.9,
|
|
"acInsufInfo": false,
|
|
"obtainAllPrivilege": false,
|
|
"obtainUserPrivilege": false,
|
|
"obtainOtherPrivilege": false,
|
|
"userInteractionRequired": true
|
|
}
|
|
]
|
|
},
|
|
"weaknesses": [
|
|
{
|
|
"source": "nvd@nist.gov",
|
|
"type": "Primary",
|
|
"description": [
|
|
{
|
|
"lang": "en",
|
|
"value": "CWE-352"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"configurations": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:magento:magento:*:*:*:*:open_source:*:*:*",
|
|
"versionEndExcluding": "1.9.4.2",
|
|
"matchCriteriaId": "175A1F6D-A026-4D73-BAA3-F02997413264"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:magento:magento:*:*:*:*:commerce:*:*:*",
|
|
"versionEndExcluding": "1.14.4.2",
|
|
"matchCriteriaId": "E41B3DA4-247E-41F6-89F0-1527036DA3CC"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:magento:magento:*:*:*:*:open_source:*:*:*",
|
|
"versionStartIncluding": "2.1.0",
|
|
"versionEndExcluding": "2.1.18",
|
|
"matchCriteriaId": "DE066118-96FB-423F-B962-F904ACD6340C"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:magento:magento:*:*:*:*:open_source:*:*:*",
|
|
"versionStartIncluding": "2.2.0",
|
|
"versionEndExcluding": "2.2.9",
|
|
"matchCriteriaId": "C7822059-9FC0-45E5-826B-4DF2AB07F2BD"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:a:magento:magento:*:*:*:*:open_source:*:*:*",
|
|
"versionStartIncluding": "2.3.0",
|
|
"versionEndExcluding": "2.3.2",
|
|
"matchCriteriaId": "6B8C5A27-2957-4373-B0FE-8C7585B4B04E"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-33",
|
|
"source": "psirt@adobe.com",
|
|
"tags": [
|
|
"Vendor Advisory"
|
|
]
|
|
}
|
|
]
|
|
} |