Description

Magento Community Edition and Enterprise Edition before 2.0.10 and 2.1.x before 2.1.2 have CSRF resulting in deletion of a customer address from an address book, aka APPSEC-1433.

Remediation

References

CVE-2018-5301

Related Vulnerabilities

WordPress Plugin Contact Form by BestWebSoft Cross-Site Scripting (3.81)

ProjectSend Improper Privilege Management Vulnerability (CVE-2020-28874)

WordPress Plugin Gift Vouchers (Gift Cards and Packages) (WooCommerce Supported) SQL Injection (1.0.5)

WordPress Plugin Download Monitor Unspecified Vulnerability (1.9.6)

WordPress Plugin Social Gallery and Widget Security Bypass (2.2.5)

Severity

Medium

Classification

CVE-2018-5301 CWE-352 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Tags

Missing Update Known Vulnerabilities