CVE-2023-41879

Magento LTS is the official OpenMage LTS codebase. Guest orders may be viewed without authentication using a "guest-view" cookie which contains the order's "protect_code". This code is 6 hexadecimal characters which is arguably not enough to prevent a brute-force attack. Exposing each order would require a separate brute force attack. This issue has been patched in versions 19.5.1 and 20.1.1.

CVSS v3 7.5 HIGH

7.5^/10

CVSS v3 : HIGH

Vector :

Exploitability : 3.9 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

References

Link	Resource
https://github.com/OpenMage/magento-lts/commit/2a2a2fb504247e8966f8ffc2e17d614be5d43128	Patch
https://github.com/OpenMage/magento-lts/commit/31e74ac5d670b10001f88f038046b62367f15877	Patch
https://github.com/OpenMage/magento-lts/releases/tag/v19.5.1	Release Notes
https://github.com/OpenMage/magento-lts/releases/tag/v20.1.1	Release Notes
https://github.com/OpenMage/magento-lts/security/advisories/GHSA-9358-cpvx-c2qp	Exploit Third Party Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:openmage:magento:::::lts:::*
	cpe:2.3:a:openmage:magento:::::lts:::*

History

No history.

Information

Published : 2023-09-11 22:15

Updated : 2023-09-15 17:30

NVD link : CVE-2023-41879

Mitre link : CVE-2023-41879

CVE.ORG link : CVE-2023-41879

JSON object : View

Products Affected

openmage

magento

CWE

CWE-330

Use of Insufficiently Random Values

{"id": "CVE-2023-41879", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}]}, "published": "2023-09-11T22:15:08.267", "references": [{"url": "https://github.com/OpenMage/magento-lts/commit/2a2a2fb504247e8966f8ffc2e17d614be5d43128", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/OpenMage/magento-lts/commit/31e74ac5d670b10001f88f038046b62367f15877", "tags": ["Patch"], "source": "security-advisories@github.com"}, {"url": "https://github.com/OpenMage/magento-lts/releases/tag/v19.5.1", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/OpenMage/magento-lts/releases/tag/v20.1.1", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/OpenMage/magento-lts/security/advisories/GHSA-9358-cpvx-c2qp", "tags": ["Exploit", "Third Party Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-330"}]}], "descriptions": [{"lang": "en", "value": "Magento LTS is the official OpenMage LTS codebase. Guest orders may be viewed without authentication using a \"guest-view\" cookie which contains the order's \"protect_code\". This code is 6 hexadecimal characters which is arguably not enough to prevent a brute-force attack. Exposing each order would require a separate brute force attack. This issue has been patched in versions 19.5.1 and 20.1.1."}, {"lang": "es", "value": "Magento LTS es el c\u00f3digo base oficial de OpenMage LTS. Los pedidos de invitados se pueden ver sin autenticaci\u00f3n utilizando una cookie de \"guest-view\" que contiene el \"protect_code\" del pedido. Este c\u00f3digo tiene 6 caracteres hexadecimales, lo que podr\u00eda decirse que no es suficiente para evitar un ataque de fuerza bruta. Exponer cada orden requerir\u00eda un ataque de fuerza bruta por separado. Este problema se solucion\u00f3 en las versiones 19.5.1 y 20.1.1."}], "lastModified": "2023-09-15T17:30:27.577", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:openmage:magento:*:*:*:*:lts:*:*:*", "vulnerable": true, "matchCriteriaId": "C2C082C2-33B8-42AA-A80D-7FC64CBEA8A4", "versionEndExcluding": "19.5.1"}, {"criteria": "cpe:2.3:a:openmage:magento:*:*:*:*:lts:*:*:*", "vulnerable": true, "matchCriteriaId": "C0ACC44D-FE37-4C32-B49F-DD00D3CAA1DA", "versionEndExcluding": "20.1.1", "versionStartIncluding": "20.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}