Description

A cross-site request forgery vulnerability exists in the GiftCardAccount removal feature for Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2.

Remediation

References

CVE-2019-7947

Related Vulnerabilities

WordPress Plugin Browser Rejector Remote File Inclusion (2.10)

Moodle Permissions, Privileges, and Access Controls Vulnerability (CVE-2014-0123)

WordPress Plugin Minimal Coming Soon & Maintenance Mode-Coming Soon Page Open Redirect (1.85)

Drupal Core 4.7.x Arbitrary Code Execution (4.7.0 - 4.7.5)

Joomla Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2017-7984)

Severity

Medium

Classification

CVE-2019-7947 CWE-352 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Tags

Missing Update Known Vulnerabilities