Miggo Logo

CVE-2019-7898: Magento 2 Community Edition Information Disclosure

5.3

CVSS Score
3.0

Basic Information

EPSS Score
0.18521%
Published
5/24/2022
Updated
2/12/2024
KEV Status
No
Technology
TechnologyPHP

Technical Details

CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
magento/community-editioncomposer>= 2.1, < 2.1.182.1.18
magento/community-editioncomposer>= 2.2, < 2.2.92.2.9
magento/community-editioncomposer>= 2.3, < 2.3.22.3.2

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from missing product status validation when accessing downloadable product samples. In Magento's architecture:

  1. The Sample controller's execute() method handles download requests, making it the primary entry point where input validation (product ID + status check) should occur
  2. The Download helper's resource retrieval is a secondary validation layer that would need to confirm product availability

Though exact patch code isn't shown, the CWE-20 classification and Magento's security bulletin both indicate these core input processing points would require modifications to add product status checks. The medium confidence reflects educated inference based on Magento's pattern of handling downloadable products and typical vulnerability patterns in controller actions.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

S*mpl*s o* *is**l** *ownlo****l* pro*u*ts *r* ****ssi*l* in M***nto Op*n Sour** prior to *.*.*.*, *n* M***nto *omm*r** prior to *.**.*.*, M***nto *.* prior to *.*.**, M***nto *.* prior to *.*.*, M***nto *.* prior to *.*.* *u* to in***qu*t* v*li**tion

Reasoning

T** vuln*r**ility st*ms *rom missin* pro*u*t st*tus v*li**tion w**n ****ssin* *ownlo****l* pro*u*t s*mpl*s. In M***nto's *r**it**tur*: *. T** S*mpl* *ontroll*r's *x**ut*() m*t*o* **n*l*s *ownlo** r*qu*sts, m*kin* it t** prim*ry *ntry point w**r* inpu