Magento up to 2.1.17/2.2.8/2.3.1 Pseudo Random Number Generator cryptographic issue

Summaryinfo

A vulnerability was found in Magento up to 2.1.17/2.2.8/2.3.1 and classified as problematic. Affected is an unknown function of the component Pseudo Random Number Generator. Executing a manipulation can lead to cryptographic issue. This vulnerability is tracked as CVE-2019-7860. The attack can be launched remotely. No exploit exists. It is suggested to upgrade the affected component.

Detailsinfo

A vulnerability classified as critical was found in Magento up to 2.1.17/2.2.8/2.3.1. This vulnerability affects an unknown code of the component Pseudo Random Number Generator. The manipulation with an unknown input leads to a cryptographic issue vulnerability. The CWE definition for the vulnerability is CWE-310. As an impact it is known to affect confidentiality. CVE summarizes:

A cryptographically weak pseudo-rando number generator is used in multiple security relevant contexts in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2.

The weakness was disclosed 08/02/2019 (Website). The advisory is available at magento.com. This vulnerability was named CVE-2019-7860 since 02/12/2019. The exploitation appears to be easy. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. The technical details are unknown and an exploit is not available. This vulnerability is assigned to T1600 by the MITRE ATT&CK project.

Upgrading to version 2.1.18, 2.2.9 or 2.3.2 eliminates this vulnerability.

The entries VDB-136358, VDB-139393, VDB-139394 and VDB-139395 are pretty similar. If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• E-Commerce Management Software

Name

• Magento

Version

• 2.1.0
• 2.1.1
• 2.1.2
• 2.1.3
• 2.1.4
• 2.1.5
• 2.1.6
• 2.1.7
• 2.1.8
• 2.1.9
• 2.1.10
• 2.1.11
• 2.1.12
• 2.1.13
• 2.1.14
• 2.1.15
• 2.1.16
• 2.1.17
• 2.2.0
• 2.2.1
• 2.2.2
• 2.2.3
• 2.2.4
• 2.2.5
• 2.2.6
• 2.2.7
• 2.2.8
• 2.3.0
• 2.3.1

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion