Magento had not correctly set concurrent sessions to expire. A customer could log out under the mistaken assumption that their sessions had expired, but later, an attacker could access the account through one of the unexpired sessions.

Part of patch: MAGENTO 2.0.16 AND 2.1.9 SECURITY UPDATE

This vulnerability affects the following application versions:

  • Magento 2.1.5
  • Magento 2.1.6
  • Magento 2.1.7
  • Magento 2.1.8

Skriv et svar

Din e-mailadresse vil ikke blive publiceret. Krævede felter er markeret med *