-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
PHPPHP| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| klaviyo/magento2-extension | composer | >= 1.0.0, < 3.0.0 | 3.0.0 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from improper handling of guest cart identifiers. The key evidence comes from the patch in PR#107 which modifies CartSearchRepository.php to use masked quote IDs instead of raw IDs. The original afterGetList implementation likely exposed raw quote IDs through the Magento API, allowing attackers to hijack guest carts by enumerating these IDs. The researcher's PoC script specifically targets quote IDs to reclaim carts, which would leverage this exposure. The CWE-200 classification confirms this is an information exposure issue.
Ongoing coverage of React2Shell