medium5.3
CVE-2019-7899
Magento 2 Community Edition Information Disclosure
Impact
Names of disabled downloadable products could be disclosed due to inadequate validation of user input in Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2.
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| composer | magento/community-edition | >= 2.1.0, < 2.1.18 | 2.1.18 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Magento | Magento | before 1.9.4.2 before 1.14.4.2 from 2.1.0 before 2.1.18 from 2.2.0 before 2.2.9 from 2.3.0 before 2.3.2 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-33
- https://github.com/advisories/GHSA-274w-2j5w-m2xj
- https://nvd.nist.gov/vuln/detail/CVE-2019-7899
- https://web.archive.org/web/20220121011306/https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-33
- https://github.com/FriendsOfPHP/security-advisories/blob/master/magento/magento1ce/CVE-2019-7899.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/magento/magento1ee/CVE-2019-7899.yaml
- https://github.com/FriendsOfPHP/security-advisories/blob/master/magento/product-community-edition/CVE-2019-7899.yaml