Description

A cross-site request forgery vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can result in unintended deletion of user roles.

Remediation

References

CVE-2019-7874

Related Vulnerabilities

phpMyAdmin Server-Side Request Forgery (SSRF) Vulnerability (CVE-2017-1000017)

WordPress Plugin Simple Job Board Cross-Site Scripting (2.4.3)

WordPress Plugin Mobile App Native (Make a mobile app-Native iPhone & Android Mobile App FREE) Arbitrary File Upload (3.0)

Joomla Other Vulnerability (CVE-2006-7009)

WordPress Plugin Easy Appointments Cross-Site Scripting (1.11.7)

Severity

Medium

Classification

CVE-2019-7874 CWE-352 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Tags

Missing Update Known Vulnerabilities