Description

A cross-site request forgery vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can result in unintended deletion of user roles.

Remediation

References

CVE-2019-7874

Related Vulnerabilities

Ruby on Rails CVE-2018-16477 Vulnerability (CVE-2018-16477)

OpenVPN AS Improper Authentication Vulnerability (CVE-2020-8953)

WordPress Plugin iThemes Security (formerly Better WP Security) Cross-Site Scripting (3.2.4)

WordPress Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2014-9032)

WordPress Plugin Quotes and Tips by BestWebSoft Cross-Site Scripting (1.19)

Severity

Medium

Classification

CVE-2019-7874 CWE-352 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Tags

Missing Update Known Vulnerabilities