Insufficient Logging and Monitoring in Magento Products
CVE-2019-8123

5.3MEDIUM

Key Information:

Vendor
Adobe
Status
Magento 1& 2
Vendor
CVE Published:
5 November 2019

Summary

An insufficient logging and monitoring vulnerability affects various versions of Magento, allowing potential attackers to exploit gaps in tracking configuration changes. The logging mechanism lacks adequate detail for effective oversight, increasing the risk of unauthorized modifications going unnoticed.

Affected Version(s)

Magento 1& 2 Magento Open Source prior to 1.9.4.3, and Magento Commerce prior to 1.14.4.3, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p2

References

https://magento.com/security/patches/supee-11219
x_refsource_MISC

CVSS V3.1

Score:
5.3
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.