CVE-2019-8155 (GCVE-0-2019-8155)

Vulnerability from cvelistv5 – Published: 2019-11-05 23:52 – Updated: 2024-08-04 21:10
VLAI?
Summary
Magento prior to 1.9.4.3 and prior to 1.14.4.3 included a user's CSRF token in the URL of a GET request. This could be exploited by an attacker with access to network traffic to perform unauthorized actions.
Severity ?
No CVSS data available.
CWE
  • Information leakage
Assigner
References
Impacted products
Vendor Product Version
Adobe Systems Incorporated Magento 1 Affected: Magento Open Source prior to 1.9.4.3
Affected: Magento Commerce prior to 1.14.4.3
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-04T21:10:33.496Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://magento.com/security/patches/supee-11219"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Magento 1",
          "vendor": "Adobe Systems Incorporated",
          "versions": [
            {
              "status": "affected",
              "version": "Magento Open Source prior to 1.9.4.3"
            },
            {
              "status": "affected",
              "version": "Magento Commerce prior to 1.14.4.3"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Magento prior to 1.9.4.3 and prior to 1.14.4.3 included a user\u0027s CSRF token in the URL of a GET request. This could be exploited by an attacker with access to network traffic to perform unauthorized actions."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Information leakage",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2019-11-05T23:52:16",
        "orgId": "078d4453-3bcd-4900-85e6-15281da43538",
        "shortName": "adobe"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://magento.com/security/patches/supee-11219"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "psirt@adobe.com",
          "ID": "CVE-2019-8155",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Magento 1",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Magento Open Source prior to 1.9.4.3"
                          },
                          {
                            "version_value": "Magento Commerce prior to 1.14.4.3"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Adobe Systems Incorporated"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Magento prior to 1.9.4.3 and prior to 1.14.4.3 included a user\u0027s CSRF token in the URL of a GET request. This could be exploited by an attacker with access to network traffic to perform unauthorized actions."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Information leakage"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://magento.com/security/patches/supee-11219",
              "refsource": "MISC",
              "url": "https://magento.com/security/patches/supee-11219"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "078d4453-3bcd-4900-85e6-15281da43538",
    "assignerShortName": "adobe",
    "cveId": "CVE-2019-8155",
    "datePublished": "2019-11-05T23:52:16",
    "dateReserved": "2019-02-12T00:00:00",
    "dateUpdated": "2024-08-04T21:10:33.496Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1",
  "vulnerability-lookup:meta": {
    "fkie_nvd": {
      "configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:magento:magento:*:*:*:*:open_source:*:*:*\", \"versionStartIncluding\": \"1.5.0.0\", \"versionEndExcluding\": \"1.9.4.3\", \"matchCriteriaId\": \"D463F1B6-7A1A-45A6-A2B4-654FAFD0E231\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:magento:magento:*:*:*:*:commerce:*:*:*\", \"versionStartIncluding\": \"1.9.0.0\", \"versionEndExcluding\": \"1.14.4.3\", \"matchCriteriaId\": \"795C485A-D4B2-4B67-9766-D00BC6BE7FA1\"}]}]}]",
      "descriptions": "[{\"lang\": \"en\", \"value\": \"Magento prior to 1.9.4.3 and prior to 1.14.4.3 included a user\u0027s CSRF token in the URL of a GET request. This could be exploited by an attacker with access to network traffic to perform unauthorized actions.\"}, {\"lang\": \"es\", \"value\": \"Magento versiones anteriores a la versi\\u00f3n 1.9.4.3 y versiones anterior a 1.14.4.3, inclu\\u00eda el token de CSRF de un usuario en la URL de una petici\\u00f3n GET. Esto podr\\u00eda ser explotado por parte de un atacante con acceso al tr\\u00e1fico de red para realizar acciones no autorizadas.\"}]",
      "id": "CVE-2019-8155",
      "lastModified": "2024-11-21T04:49:23.277",
      "metrics": "{\"cvssMetricV31\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.1\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\", \"baseScore\": 7.5, \"baseSeverity\": \"HIGH\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"scope\": \"UNCHANGED\", \"confidentialityImpact\": \"HIGH\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 3.9, \"impactScore\": 3.6}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:L/Au:N/C:P/I:N/A:N\", \"baseScore\": 5.0, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"LOW\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"PARTIAL\", \"integrityImpact\": \"NONE\", \"availabilityImpact\": \"NONE\"}, \"baseSeverity\": \"MEDIUM\", \"exploitabilityScore\": 10.0, \"impactScore\": 2.9, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": false}]}",
      "published": "2019-11-06T00:15:12.763",
      "references": "[{\"url\": \"https://magento.com/security/patches/supee-11219\", \"source\": \"psirt@adobe.com\", \"tags\": [\"Vendor Advisory\"]}, {\"url\": \"https://magento.com/security/patches/supee-11219\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Vendor Advisory\"]}]",
      "sourceIdentifier": "psirt@adobe.com",
      "vulnStatus": "Modified",
      "weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-352\"}]}]"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2019-8155\",\"sourceIdentifier\":\"psirt@adobe.com\",\"published\":\"2019-11-06T00:15:12.763\",\"lastModified\":\"2024-11-21T04:49:23.277\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Magento prior to 1.9.4.3 and prior to 1.14.4.3 included a user\u0027s CSRF token in the URL of a GET request. This could be exploited by an attacker with access to network traffic to perform unauthorized actions.\"},{\"lang\":\"es\",\"value\":\"Magento versiones anteriores a la versi\u00f3n 1.9.4.3 y versiones anterior a 1.14.4.3, inclu\u00eda el token de CSRF de un usuario en la URL de una petici\u00f3n GET. Esto podr\u00eda ser explotado por parte de un atacante con acceso al tr\u00e1fico de red para realizar acciones no autorizadas.\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:P/I:N/A:N\",\"baseScore\":5.0,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":10.0,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-352\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:magento:magento:*:*:*:*:open_source:*:*:*\",\"versionStartIncluding\":\"1.5.0.0\",\"versionEndExcluding\":\"1.9.4.3\",\"matchCriteriaId\":\"D463F1B6-7A1A-45A6-A2B4-654FAFD0E231\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:magento:magento:*:*:*:*:commerce:*:*:*\",\"versionStartIncluding\":\"1.9.0.0\",\"versionEndExcluding\":\"1.14.4.3\",\"matchCriteriaId\":\"795C485A-D4B2-4B67-9766-D00BC6BE7FA1\"}]}]}],\"references\":[{\"url\":\"https://magento.com/security/patches/supee-11219\",\"source\":\"psirt@adobe.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"https://magento.com/security/patches/supee-11219\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]}]}}"
  }
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.