Improper form key validation leads to possible CSRF attacks on several forms throughout Magento. As a result, a malicious user could create a phishing form that, when clicked by a user, would execute an action such as update cart or login. Note: This issue affects only older versions of Magento.
Part of patch SUPEE-8788
This vulnerability affects the following application versions:
- Magento 1.6.0.0
- Magento 1.6.1.0
- Magento 1.6.2.0
- Magento 1.7.0.0
- Magento 1.7.0.1
- Magento 1.7.0.2
- Magento 1.8.0.0
- Magento 1.8.1.0
- Magento 1.9.0.0
- Magento 1.9.0.1
- Magento 1.9.1.0
- Magento 1.9.1.1
- Magento 1.9.2.0
- Magento 1.9.2.1
- Magento 1.9.2.2
- Magento 1.9.2.3
- Magento 1.9.2.4