Cross site request forgery vulnerability that could change the status of orders. The attack was possible if an admin had the Add Secret Key to URLs disabled.

Part of update Magento 2.2.6 and 2.1.15 Security Update

This vulnerability affects the following application versions:

  • Magento 2.2.1
  • Magento 2.2.2
  • Magento 2.2.3
  • Magento 2.2.4
  • Magento 2.2.5

Skriv et svar

Din e-mailadresse vil ikke blive publiceret. Krævede felter er markeret med *