Description

A cross-site request forgery vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can result in unintended deletion of user roles.

Remediation

References

CVE-2019-7874

Related Vulnerabilities

MySQL CVE-2021-2087 Vulnerability (CVE-2021-2087)

Moodle Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2009-0499)

Oracle HTTP Server Other Vulnerability (CVE-2020-35166)

WordPress Plugin Tweet Wheel Spam (0.3)

Magento Server-Side Request Forgery (SSRF) Vulnerability (CVE-2019-7892)

Severity

Medium

Classification

CVE-2019-7874 CWE-352 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N

Tags

Missing Update Known Vulnerabilities