CVE-2023-41879
Magento LTS's guest order "protect code" can be brute-forced too easily
概要
Magento LTS's guest order "protect code" can be brute-forced too easily
原文の説明
取得元が公開している説明をそのまま載せています (多くは英語)。
Magento LTS is the official OpenMage LTS codebase. Guest orders may be viewed without authentication using a "guest-view" cookie which contains the order's "protect_code". This code is 6 hexadecimal characters which is arguably not enough to prevent a brute-force attack. Exposing each order would require a separate brute force attack. This issue has been patched in versions 19.5.1 and 20.1.1.
出典: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
参照URL
- advisory github.com
- advisory github.com
- advisory nvd.nist.gov
- patch github.com
- patch github.com
- web github.com
- web github.com