Insecure authentication and session management vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1.

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• magento magento2.2.0 and later · before 2.2.10
• magento magento2.3.0 and later · before 2.3.2
• magento magento2.3.2

Versions reported by the vendor

Affected version ranges reported by the assigning authority (adobe). Independent of NVD's CPE analysis and usually ahead of it.

• Adobe Systems Incorporated Magento 2

  • Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1affected

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2016-4010Magento CE and EE before 2.0.6 allows remote attackers to conduct PHP objection injection attacks and execute arbitrary PHP code via crafted
  67This week
• CVE-2021-21029Magento Commerce Reflected Cross-site Scripting Vulnerability Could Lead To Arbitrary JavaScript Execution
  44Plan
• CVE-2019-7139An unauthenticated user can execute SQL statements that allow arbitrary read access to the underlying database, which causes sensitive data
  44Plan

Published before and after this one in the same product

• ← EarlierCVE-2019-8093Nov 5, 2019 · An arbitrary file access vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1.
  35Monitor
• ← EarlierCVE-2019-8107Nov 5, 2019 · An arbitrary file deletion vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1.
  26Monitor
• Later →CVE-2019-8109Nov 5, 2019 · A remote code execution vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1.
  32Monitor

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

Authentication is added route by route instead of being enforced in one place. When a route added later bypasses the shared middleware, the session check never runs for it.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1app.use("/admin", requireSession, adminRouter);2
3// Route added later skips the middleware4app.post("/admin-api/config", updateConfig);

1const admin = express.Router();2admin.use(requireSession, requireRole("admin"));3
4admin.post("/config", updateConfig);5app.use("/admin", admin);

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.