CVE-2019-8118: Magento 2 Community Edition Weak Cryptography
Magento 2 Community Edition Weak Cryptography
Other sources
Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 uses weak cryptographic function to store the failed login attempts for customer accounts.
— GitHub
PRODSECBUG-2452: User Password is stored in clear
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/magento/community-editionto a version that resolves this vulnerability.Fixed in 2.3.3 - Upgrade
Upgrade
composer/magento/community-editionto a version that resolves this vulnerability.Fixed in 2.2.10 - Upgrade
Upgrade
composer/magento/community-editionto a version that resolves this vulnerability.Fixed in 2.1.19 - Upgrade
Upgrade
composer/magento/product-community-editionto a version that resolves this vulnerability.Fixed in 2.2.10 - Upgrade
Upgrade
composer/magento/product-community-editionto a version that resolves this vulnerability.Fixed in 2.3.2-p2
Event History
Frequently Asked Questions
What is the severity of CVE-2019-8118?
CVE-2019-8118 has a high severity due to the use of weak cryptographic functions to store failed login attempts.
How do I fix CVE-2019-8118?
To fix CVE-2019-8118, upgrade to Magento 2.1.19, 2.2.10, or 2.3.3 or later.
What versions of Magento are affected by CVE-2019-8118?
CVE-2019-8118 affects Magento 2.1 versions prior to 2.1.19, 2.2 versions prior to 2.2.10, and 2.3 versions prior to 2.3.3.
What kind of accounts are impacted by CVE-2019-8118?
CVE-2019-8118 specifically impacts customer accounts due to improper storage of login attempt data.
Is customer data compromised due to CVE-2019-8118?
Yes, CVE-2019-8118 compromises the security of customer passwords stored in clear text after failed login attempts.