-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability involves improper access control in the two-factor authentication component, specifically in handling trusted device metadata. The controller action responsible for configuration (Configure::execute) is a primary suspect because it processes admin requests and would need user context validation. The TrustedDeviceManager::getTrustedDevices method is implicated because it directly interacts with device metadata storage. The high confidence in the controller stems from Magento's typical MVC structure where authorization checks are implemented at the controller level. The medium confidence in the model method reflects uncertainty about whether the vulnerability originates at the data retrieval layer versus the request handling layer.
PHPPHP| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| magento/community-edition | composer | >= 2.1.0, < 2.1.18 | 2.1.18 |
| magento/community-edition | composer | >= 2.2.0, < 2.2.9 | 2.2.9 |
| magento/community-edition |
| composer |
| >= 2.3.0, < 2.3.2 |
| 2.3.2 |
Ongoing coverage of React2Shell