CVE-2019-8155: CSRF
Magento prior to 1.9.4.3 and prior to 1.14.4.3 included a user's CSRF token in the URL of a GET request. This could be exploited by an attacker with access to network traffic to perform unauthorized actions.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-8155?
CVE-2019-8155 is considered a high severity vulnerability due to its potential to allow unauthorized actions via CSRF token exposure.
How do I fix CVE-2019-8155?
To fix CVE-2019-8155, update Magento to version 1.9.4.3 or later for Magento Open Source and to version 1.14.4.3 or later for Magento Commerce.
What versions of Magento are affected by CVE-2019-8155?
CVE-2019-8155 affects Magento versions prior to 1.9.4.3 for Open Source and prior to 1.14.4.3 for Commerce.
What actions can an attacker perform due to CVE-2019-8155?
An attacker can perform unauthorized actions if they can capture the CSRF token from URLs transmitted in network traffic.
Is CVE-2019-8155 a type of CSRF vulnerability?
Yes, CVE-2019-8155 is a cross-site request forgery (CSRF) vulnerability related to the exposure of user CSRF tokens.