Vulnerability Description
A cross-site request forgery vulnerability in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 can cause unwanted items to be added to a shopper's cart due to an insufficiently robust anti-CSRF token implementation.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Magento | Magento | >= 2.1.0, < 2.1.18 |
Related Weaknesses (CWE)
References
- https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-updVendor Advisory
- https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-updVendor Advisory
FAQ
What is CVE-2019-7857?
CVE-2019-7857 is a vulnerability with a CVSS score of 4.3 (MEDIUM). A cross-site request forgery vulnerability in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 can cause unwanted items to be added to a shopper's cart due to an ins...
How severe is CVE-2019-7857?
CVE-2019-7857 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2019-7857?
Check the references section above for vendor advisories and patch information. Affected products include: Magento Magento.