CVE-2019-7929: Infoleak
An information leakage vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with administrator privileges may be able to view metadata of a trusted device used by another administrator via a crafted http request.
Other sources
PRODSECBUG-2348: Sensitive data disclosure via crafted two factor edit user form
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-7929?
CVE-2019-7929 is rated as a moderate severity vulnerability.
How do I fix CVE-2019-7929?
To resolve CVE-2019-7929, upgrade to Magento version 2.1.18, 2.2.9, or 2.3.2.
Who is affected by CVE-2019-7929?
CVE-2019-7929 affects authenticated users with administrator privileges on Magento 2.1, 2.2, and 2.3 versions prior to the specified security updates.
What type of vulnerability is CVE-2019-7929?
CVE-2019-7929 is an information leakage vulnerability.
Can CVE-2019-7929 be exploited remotely?
No, CVE-2019-7929 requires authenticated access to be exploited.