-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| magento/community-edition | composer | >= 2.1.0, < 2.1.18 | 2.1.18 |
| magento/community-edition | composer | >= 2.2.0, < 2.2.9 | 2.2.9 |
| magento/community-edition | composer | >= 2.3.0, < 2.3.2 | 2.3.2 |
PHPPHPMiggo AIRoot Cause AnalysisThe vulnerability description explicitly mentions insecure credential storage due to weak cryptographic algorithms. Magento's password hashing mechanism is centralized in the Encryptor class. Historical analysis of Magento's security updates shows that this class was modified in related patches to implement bcrypt hashing. The CWE-327 classification directly aligns with weaknesses in cryptographic implementations, and the function's responsibility for password hashing makes it the primary candidate for this vulnerability.
Ongoing coverage of React2Shell