Magento LTS is the official OpenMage LTS codebase. Guest orders may be viewed without authentication using a "guest-view" cookie which contains the order's "protect_code". This code is 6 hexadecimal characters which is arguably not enough to prevent a brute-force attack. Exposing each order would require a separate brute force attack. This issue has been patched in versions 19.5.1 and 20.1.1.
Metrics
Affected Vendors & Products
| Vendors | Products |
|---|---|
| Openmage |
|
Configuration 1 [-]
|
No data.
No data.
Advisories
| Source | ID | Title |
|---|---|---|
 EUVD |
EUVD-2023-2471 | Magento LTS is the official OpenMage LTS codebase. Guest orders may be viewed without authentication using a "guest-view" cookie which contains the order's "protect_code". This code is 6 hexadecimal characters which is arguably not enough to prevent a brute-force attack. Exposing each order would require a separate brute force attack. This issue has been patched in versions 19.5.1 and 20.1.1. |
 Github GHSA |
GHSA-9358-cpvx-c2qp | Magento LTS's guest order "protect code" can be brute-forced too easily |
Fixes
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
References
History
Thu, 26 Sep 2024 17:30:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
MITRE
Status: PUBLISHED
Assigner: GitHub_M
Published:
Updated: 2024-09-26T16:55:58.992Z
Reserved: 2023-09-04T16:31:48.223Z
Link: CVE-2023-41879
Vulnrichment
Updated: 2024-08-02T19:09:49.294Z
NVD
Status : Modified
Published: 2023-09-11T22:15:08.267
Modified: 2024-11-21T08:21:50.350
Link: CVE-2023-41879
Redhat
No data.
OpenCVE Enrichment
No data.