CVE-2019-7865

At a glance

Severity: Not available
EPSS: EPSS 0.50 % · percentile 42 (2026-10-27)
State: PUBLISHED
Published: 2019-08-02
Updated: 2024-08-04
Assigner: adobe
NVD status: Modified

Description

A cross-site request forgery (CSRF) vulnerability exists in the checkout cart item of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This could be exploited at the time of editing or configuration.

Scores

Version	Score	Vector	Scored by
CVSS 3.0	HIGH 8.8	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	NVD · nvd@nist.gov (Primary)
CVSS 2.0	MEDIUM 6.8	AV:N/AC:M/Au:N/C:P/I:P/A:P	NVD · nvd@nist.gov (Primary)

Weaknesses (CWE)

CWE-352

Advisories

GHSA-wmrg-w9vg-7jqx — Magento 2 Community Edition CSRF Vulnerability

European references

ENISA EUVD · EUVD-2022-5604
GCVE · GCVE-0-2019-7865

CERT-FR advisories

CERTFR-2019-AVI-295 — Multiples vulnérabilités dans les produits Magento · cert.ssi.gouv.fr

Affected configurations (NVD CPE)

cpe:2.3:a:magento:magento:*:*:*:*:open_source:*:*:* ≥ 2.1.0 < 2.1.18
cpe:2.3:a:magento:magento:*:*:*:*:open_source:*:*:* ≥ 2.2.0 < 2.2.9
cpe:2.3:a:magento:magento:*:*:*:*:open_source:*:*:* ≥ 2.3.0 < 2.3.2

Affected products

Product	Versions
Magento 2	affected Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2

References

https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-33

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD