Description

A cryptographically weak pseudo-rando number generator is used in multiple security relevant contexts in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2.

Remediation

References

CVE-2019-7860

Related Vulnerabilities

WordPress Plugin Image News slider 'upload.php' Arbitrary File Upload (3.3)

Liferay Portal Incorrect Default Permissions Vulnerability (CVE-2021-33334)

WordPress Plugin Brizy-Page Builder Security Bypass (1.0.113)

Atlassian Jira Incorrect Behavior Order: Validate Before Canonicalize Vulnerability (CVE-2022-26137)

Drupal Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2008-0273)

Severity

High

Classification

CVE-2019-7860 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Tags

Missing Update Known Vulnerabilities