Description

Names of disabled downloadable products could be disclosed due to inadequate validation of user input in Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2.

Remediation

References

CVE-2019-7899

Related Vulnerabilities

MySQL CVE-2020-14775 Vulnerability (CVE-2020-14775)

Jenkins Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2019-10353)

ownCloud Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2013-2086)

Undertow Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling') Vulnerability (CVE-2020-10719)

Mailman Other Vulnerability (CVE-2003-0991)

Severity

Medium

Classification

CVE-2019-7899 CWE-20 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Tags

Missing Update Known Vulnerabilities