A user could inject a cross-site request forgery (CSRF) into a users cart on the Checkout page due to a missing CSRF token.
Part of patch SUPEE-10752
This vulnerability affects the following application versions:
- Magento 1.9.2.0
- Magento 1.9.2.1
- Magento 1.9.2.2
- Magento 1.9.2.3
- Magento 1.9.2.4
- Magento 1.9.3.0
- Magento 1.9.3.1
- Magento 1.9.3.2
- Magento 1.9.3.3
- Magento 1.9.3.4
- Magento 1.9.3.6
- Magento 1.9.3.7
- Magento 1.9.3.8