CVE-2019-7865
Magento 2 Community Edition CSRF Vulnerability
8.8
HIGH
CVSS 3.1
EPSS 0.06%
Description
A cross-site request forgery (CSRF) vulnerability exists in the checkout cart item of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited at the time of editing or configuration.
How to fix CVE-2019-7865
To remediate CVE-2019-7865, upgrade the affected package to a fixed version below.
- —upgrade to 2.1.18 or later
- —upgrade to 2.1.18 or later
Is CVE-2019-7865 being exploited?
Low — EPSS is 0.1%, meaning exploitation activity has not been observed at scale.
Affected packages (2)
- >= 2.1.0, < 2.1.18
- >= 2.1, < 2.1.18
CVSS scores
| Source | Version | Severity | Vector |
|---|---|---|---|
| osv | CVSS 3.1 | HIGH8.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |