5.3

CVE-2019-8113

Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1 uses cryptographically weak random number generator to brute-force the confirmation code for customer registration.

Data is provided by the National Vulnerability Database (NVD)
Magento ≫ Magento SwEditioncommerce Version >= 2.2.0 < 2.2.10
Magento ≫ Magento SwEditionopen_source Version >= 2.2.0 < 2.2.10
Magento ≫ Magento SwEditioncommerce Version >= 2.3.0 < 2.3.2
Magento ≫ Magento SwEditionopen_source Version >= 2.3.0 < 2.3.2
Magento ≫ Magento Version2.3.2 Update- SwEditioncommerce
Magento ≫ Magento Version2.3.2 Update- SwEditionopen_source
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.1% 0.248
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 5.3 3.9 1.4
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
nvd@nist.gov 5 10 2.9
AV:N/AC:L/Au:N/C:P/I:N/A:N
CWE-338 Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong.