magento/magento2 · Security
Magento 2 Community Edition DoS vulnerability
- GHSA ID
- GHSA-prw8-gqwp-f7fh
- CVE ID
- CVE-2019-7915
- Severity
- high
- Published
- Updated
- CVSS
- 7.5 · CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- CVSS v3
- 7.5 · CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Description
A denial-of-service vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. Under certain conditions, an unauthenticated attacker could force the Magento store's full page cache to serve a 404 page to customers.
References
- https://nvd.nist.gov/vuln/detail/CVE-2019-7915 ↗
- https://web.archive.org/web/20211206084839/https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13 ↗
- https://github.com/FriendsOfPHP/security-advisories/blob/master/magento/product-community-edition/CVE-2019-7915.yaml ↗
- https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13 ↗
- https://github.com/advisories/GHSA-prw8-gqwp-f7fh ↗