CVE-2019-8123:
Magento 2 Community Edition Insufficient Logging
5.3
CVSS Score
3.1
Basic Information
CVE ID
GHSA ID
EPSS Score
0.27024%
CWE
Published
5/24/2022
Updated
2/12/2024
KEV Status
No
Technology
PHP
PHPTechnical Details
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| magento/community-edition | composer | >= 2.1.0, < 2.1.19 | 2.1.19 |
| magento/community-edition | composer | >= 2.2.0, < 2.2.10 | 2.2.10 |
| magento/community-edition | composer | >= 2.3.0, < 2.3.3 | 2.3.3 |
Vulnerability Intelligence
Miggo AI
Miggo AIRoot Cause Analysis
The vulnerability centers around insufficient logging of configuration changes. While exact code diffs are unavailable, Magento's configuration management flow involves these key components:
- The Save controller action is the entry point for configuration changes
- The Config model's save() method persists the changes
In vulnerable versions, these components likely lacked:
- User identity logging
- Before/after value recording
- Timestamp granularity
- Change type identification
Confidence is medium because while these are architecturally logical locations for the flaw, the absence of commit diffs prevents absolute certainty. The patched versions (2.1.19+, 2.2.10+, 2.3.3+) would have enhanced logging in these areas based on the vulnerability description.