Improper input validation in Magento
CVE-2019-7898
Samples of disabled downloadable products are accessible in Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 due to inadequate validation of user input.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
EPSS: 0.009 (56.9th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N.
Affected products
- Magento
- N/a Magento 1 2 — versions Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2
Weakness classification (CWE)
References
- psirt@adobe.com (x_refsource_CONFIRM, Vendor Advisory)
Frequently asked questions
- What is CVE-2019-7898?
- CVE-2019-7898 is a medium-severity vulnerability in Magento, classified under Improper Input Validation. CVSS score: 5.3/10. Published 2019-08-02.
- How severe is CVE-2019-7898?
- Medium severity. CVSS v3 base score is 5.3 out of 10.