Allowed a deletion of single or all store customers. When a POST request that performed the deletion of customers was switched to GET, the lack of form_key parameter that served as a CSRF token was completely ignored, allowing the request to be used in Cross-Site Request Forgery attacks.

Part of update Magento 2.2.6 and 2.1.15 Security Update

This vulnerability affects the following application versions:

  • Magento 2.1.13
  • Magento 2.1.14
  • Magento 2.1.15
  • Magento 2.2.4
  • Magento 2.2.5

Skriv et svar

Din e-mailadresse vil ikke blive publiceret. Krævede felter er markeret med *