medium5.3
CVE-2019-7898
Magento 2 Community Edition Information Disclosure
Impact
Samples of disabled downloadable products are accessible in Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 due to inadequate validation of user input.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | magento/community-edition | >= 2.1, < 2.1.18 | 2.1.18 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Magento | Magento | before 1.9.4.2 before 1.14.4.2 from 2.1.0 before 2.1.18 from 2.2.0 before 2.2.9 from 2.3.0 before 2.3.2 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23
- https://github.com/advisories/GHSA-vqxq-3wqv-r9xp
- https://nvd.nist.gov/vuln/detail/CVE-2019-7898
- https://web.archive.org/web/20220121051916/https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23
- https://github.com/FriendsOfPHP/security-advisories/blob/master/magento/magento1ce/CVE-2019-7898.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/magento/magento1ee/CVE-2019-7898.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/magento/product-community-edition/CVE-2019-7898.yaml