Magento up to 2.2.9/2.3.2 Random Number Generator weak prng

Summaryinfo

A vulnerability classified as problematic was found in Magento up to 2.2.9/2.3.2. Affected is an unknown function of the component Random Number Generator. Executing a manipulation can lead to weak prng. This vulnerability is tracked as CVE-2019-8113. The attack can be launched remotely. No exploit exists. Upgrading the affected component is advised.

Detailsinfo

A vulnerability has been found in Magento up to 2.2.9/2.3.2 and classified as problematic. This vulnerability affects an unknown function of the component Random Number Generator. The manipulation with an unknown input leads to a weak prng vulnerability. The CWE definition for the vulnerability is CWE-338. The product uses a Pseudo-Random Number Generator (PRNG) in a security context, but the PRNG's algorithm is not cryptographically strong. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1 uses cryptographically weak random number generator to brute-force the confirmation code for customer registration.

The weakness was disclosed 11/05/2019. This vulnerability was named CVE-2019-8113 since 02/12/2019. The exploitation appears to be difficult. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. There are neither technical details nor an exploit publicly available. The MITRE ATT&CK project declares the attack technique as T1600.001.

Upgrading to version 2.2.10, 2.3.2-p1 or 2.3.3 eliminates this vulnerability.

The entries VDB-145016, VDB-145015, VDB-145014 and VDB-145013 are pretty similar. Once again VulDB remains the best source for vulnerability data.

Productinfo

Type

• E-Commerce Management Software

Name

• Magento

Version

• 2.2.0
• 2.2.1
• 2.2.2
• 2.2.3
• 2.2.4
• 2.2.5
• 2.2.6
• 2.2.7
• 2.2.8
• 2.2.9
• 2.3.0
• 2.3.1
• 2.3.2

License

• open-source

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Once again VulDB remains the best source for vulnerability data.

Discussion