7.5

CVE-2019-8112

A security bypass vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An unauthenticated user can bypass the email confirmation mechanism via GET request that captures relevant account data obtained from the POST response related to new user creation.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Magento ≫ Magento SwEdition commerce Version >= 2.2.0 < 2.2.10
Magento ≫ Magento SwEdition open_source Version >= 2.2.0 < 2.2.10
Magento ≫ Magento SwEdition commerce Version >= 2.3.0 < 2.3.2
Magento ≫ Magento SwEdition open_source Version >= 2.3.0 < 2.3.2
Magento ≫ Magento Version 2.3.2 Update - SwEdition commerce
Magento ≫ Magento Version 2.3.2 Update - SwEdition open_source
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 0.56% 0.421
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.5 3.9 3.6
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
NIST 5 10 2.9
AV:N/AC:L/Au:N/C:P/I:N/A:N
CWE-345 Insufficient Verification of Data Authenticity

The product does not sufficiently verify the origin or authenticity of data, in a way that causes it to accept invalid data.

https://magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update
Patch
Vendor Advisory