-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability description indicates CSRF in cart item operations. Magento's cart update functionality is typically handled by UpdatePost controller. CSRF vulnerabilities in Magento often stem from missing form key validation in controller actions. The patched versions likely added $this->_validateFormKey() check in execute() method, which would be absent in vulnerable versions. This matches Magento's typical CSRF fix pattern and the vulnerability's context of cart item manipulation.
PHPPHP| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| magento/community-edition | composer | >= 2.1.0, < 2.1.18 | 2.1.18 |
| magento/community-edition | composer | >= 2.2.0, < 2.2.9 | 2.2.9 |
| magento/community-edition |
| composer |
| >= 2.3.0, < 2.3.2 |
| 2.3.2 |
| magento/product-community-edition | composer | >= 2.1, < 2.1.18 | 2.1.18 |
| magento/product-community-edition | composer | >= 2.2, < 2.2.9 | 2.2.9 |
| magento/product-community-edition | composer | >= 2.3, < 2.3.2 | 2.3.2 |
Ongoing coverage of React2Shell