CVE-2019-7929: Infoleak
First published: Tue Jun 25 2019(Updated: )
An information leakage vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with administrator privileges may be able to view metadata of a trusted device used by another administrator via a crafted http request.
Credit: psirt@adobe.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| composer/magento/product-community-edition | >=2.1<2.1.18>=2.2<2.2.9>=2.3<2.3.2 | |
| composer/magento/community-edition | >=2.3.0<2.3.2 | 2.3.2 |
| composer/magento/community-edition | >=2.2.0<2.2.9 | 2.2.9 |
| composer/magento/community-edition | >=2.1.0<2.1.18 | 2.1.18 |
| CentOS Libgcc | >=2.1.0<2.1.18 | |
| CentOS Libgcc | >=2.2.0<2.2.9 | |
| CentOS Libgcc | >=2.3.0<2.3.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-33
- https://nvd.nist.gov/vuln/detail/CVE-2019-7929
- https://web.archive.org/web/20220121011306/https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-33
- https://github.com/advisories/GHSA-h522-94xp-2xr6 (Advisory)
- https://github.com/FriendsOfPHP/security-advisories/blob/master/magento/product-community-edition/CVE-2019-7929.yaml
Frequently Asked Questions
What is the severity of CVE-2019-7929?
CVE-2019-7929 is rated as a moderate severity vulnerability.
How do I fix CVE-2019-7929?
To resolve CVE-2019-7929, upgrade to Magento version 2.1.18, 2.2.9, or 2.3.2.
Who is affected by CVE-2019-7929?
CVE-2019-7929 affects authenticated users with administrator privileges on Magento 2.1, 2.2, and 2.3 versions prior to the specified security updates.
What type of vulnerability is CVE-2019-7929?
CVE-2019-7929 is an information leakage vulnerability.
Can CVE-2019-7929 be exploited remotely?
No, CVE-2019-7929 requires authenticated access to be exploited.
- collector/friends-of-php
- agent/type
- agent/first-publish-date
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-h522-94xp-2xr6
- alias/CVE-2019-7929
- agent/software-canonical-lookup
- agent/weakness
- agent/severity
- agent/references
- agent/description
- collector/github-advisory
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/event
- agent/trending
- agent/source
- agent/author
- agent/softwarecombine
- agent/tags
- collector/nvd-cve
- source/NVD
- agent/software-canonical-lookup-request
- collector/nvd-index
- package-manager/composer
- vendor/magento
- canonical/centos libgcc
- version/centos libgcc/2.1.0
- version/centos libgcc/2.2.0
- version/centos libgcc/2.3.0