Description

An insufficient logging and monitoring vulnerability exists in Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3. Failure to track admin actions related to design configuration could lead to repudiation attacks.

Remediation

References

CVE-2019-8124

Related Vulnerabilities

Magento Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2020-9691)

WordPress Plugin BePro Listings Arbitrary File Upload (2.2.0020)

TYPO3 Improper Link Resolution Before File Access ('Link Following') Vulnerability (CVE-2014-9508)

Restlet Framework Deserialization of Untrusted Data Vulnerability (CVE-2013-4271)

WordPress Plugin YITH WooCommerce Questions and Answers Security Bypass (1.1.9)

Severity

High

Classification

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Tags

Missing Update Known Vulnerabilities CWE-345 CVE-2019-8124