CVE-2019-7951: Infoleak

Q: What versions are affected by CVE-2019-7951?

CVE-2019-7951 affects Magento 2.1 prior to 2.1.18, 2.2 prior to 2.2.9, and 2.3 prior to 2.3.2.

Q: What is the severity of CVE-2019-7951?

The severity of CVE-2019-7951 is high due to the potential for customer information leakage.

Q: How do I fix CVE-2019-7951?

You can fix CVE-2019-7951 by updating to Magento 2.1.18, 2.2.9, or 2.3.2.

Q: What type of vulnerability is CVE-2019-7951?

CVE-2019-7951 is an information leakage vulnerability related to improper access control in SOAP web services.

Q: Can CVE-2019-7951 be exploited by remote attackers?

Yes, CVE-2019-7951 can be exploited by remote attackers through crafted SOAP requests.

Published Jun 25, 2019

Updated

An information leakage vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. A SOAP web service endpoint does not properly enforce parameters related to access control. This could be abused to leak customer information via crafted SOAP requests.

Other sources

PRODSECBUG-2430: Security bypass via crafted SOAP requests

Affected Software

7 affected componentsFixes available

composer/magento/product-community-edition>=2.1, <2.1.18, >=2.2, <2.2.9, >=2.3, <2.3.2

composer/magento/community-edition>=2.3.0<2.3.2

2.3.2

composer/magento/community-edition>=2.2.0<2.2.9

2.2.9

composer/magento/community-edition>=2.1.0<2.1.18

2.1.18

Magento Magento>=2.1.0<2.1.18

Magento Magento>=2.2.0<2.2.9

Magento Magento>=2.3.0<2.3.2

Event History

Jun 25, 2019

Advisory Published

12:00 AM

Aug 2, 2019

CVE Published

via MITRE·09:36 PM

Data Sourced

via MITRE·09:36 PM

DescriptionWeakness

Frequently Asked Questions

What versions are affected by CVE-2019-7951?

CVE-2019-7951 affects Magento 2.1 prior to 2.1.18, 2.2 prior to 2.2.9, and 2.3 prior to 2.3.2.

What is the severity of CVE-2019-7951?