CVE-2019-7929: Magento 2 Community Edition Information Disclosure
An information leakage vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with administrator privileges may be able to view metadata of a trusted device used by another administrator via a crafted http request.
Other sources
Magento 2 Community Edition Information Disclosure
— Packagist
PRODSECBUG-2348: Sensitive data disclosure via crafted two factor edit user form
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/magento/community-editionto a version that resolves this vulnerability.Fixed in 2.3.2 - Upgrade
Upgrade
composer/magento/community-editionto a version that resolves this vulnerability.Fixed in 2.2.9 - Upgrade
Upgrade
composer/magento/community-editionto a version that resolves this vulnerability.Fixed in 2.1.18 - Upgrade
Upgrade
composer/magento/product-community-editionto a version that resolves this vulnerability.Fixed in 2.1.18 - Upgrade
Upgrade
composer/magento/product-community-editionto a version that resolves this vulnerability.Fixed in 2.2.9 - Upgrade
Upgrade
composer/magento/product-community-editionto a version that resolves this vulnerability.Fixed in 2.3.2
Event History
Frequently Asked Questions
What is the severity of CVE-2019-7929?
CVE-2019-7929 is rated as a moderate severity vulnerability.
How do I fix CVE-2019-7929?
To resolve CVE-2019-7929, upgrade to Magento version 2.1.18, 2.2.9, or 2.3.2.
Who is affected by CVE-2019-7929?
CVE-2019-7929 affects authenticated users with administrator privileges on Magento 2.1, 2.2, and 2.3 versions prior to the specified security updates.
What type of vulnerability is CVE-2019-7929?
CVE-2019-7929 is an information leakage vulnerability.
Can CVE-2019-7929 be exploited remotely?
No, CVE-2019-7929 requires authenticated access to be exploited.