同じ製品で同じ時期に公表された 3 件の脆弱性の 1 つです。まとめた解説: OpenMage Magento LTSに脆弱性3件、修正版が公開
OpenMage magento-lts before 20.18.2 Account Takeover via Predictable Confirmation Key
概要
OpenMage magento-lts before 20.18.2 and 21.0.0-beta pre-releases before 21.0.0-beta3 generate customer email-confirmation keys with md5(uniqid()) and customer and administrator password-reset tokens with the non-cryptographic uniqHash(). Unauthenticated attackers can brute-force the roughly 20-bit c...
影響パッケージ
| パッケージ | 影響を受ける版 → 修正版 | |
|---|---|---|
| OpenMagemagento-lts |
21.0.0-beta1 以上 21.0.0-beta3 未満→ 21.0.0-beta3 |
21.0.0-beta3 |
原文の説明 取得元が公開している説明をそのまま載せています (多くは英語)。
OpenMage magento-lts before 20.18.2 and 21.0.0-beta pre-releases before 21.0.0-beta3 generate customer email-confirmation keys with md5(uniqid()) and customer and administrator password-reset tokens with the non-cryptographic uniqHash(). Unauthenticated attackers can brute-force the roughly 20-bit confirmation key via the unrate-limited confirmAction endpoint to log in as pending customers, or predict administrator reset tokens after recovering generator state.
出典: CVE.org (CVE Program・cvelistV5) NVD