GHSA-fp5m-4mqh-849p CVE-2019-8123
Magento 2 Community Edition Insufficient Logging
- Severity
- 5.3 / 10
- Medium · CVSS 3.1
- Exploit chance (EPSS)
- 0.81%
- Chance of exploitation in the next 30 days. Higher than 56.96% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-778 Insufficient Logging
- Fix
2.1.19- Upgrade magento/community-edition to this version or later
Description
An insufficient logging and monitoring vulnerability exists in Magento 1 prior to 1.9.4.3 and 1.14.4.3, Magento 2.1 prior to 2.1.19, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3. The logging feature required for effective monitoring did not contain sufficent data to effectively track configuration changes. As per the Magento Release 2.3.3, if you have already implemented the pre-release version of this patch (2.3.2-p1), it is highly recommended to promptly upgrade to 2.3.2-p2.
Affected versions
Packagist
| Package | Vulnerable | Fixed in |
|---|---|---|
| magento/community-edition | >= 2.1.0, < 2.1.19 |
2.1.19 |
| magento/community-edition | >= 2.2.0, < 2.2.10 |
2.2.10 |
| magento/community-edition | >= 2.3.0, < 2.3.3 |
2.3.3 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
magento/community-edition Packagist → 2.1.19
- composer
composer require magento/community-edition:^2.1.19
Severity breakdown
CVSS 3.1 5.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- None
- Scope
- Unchanged
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Weakness
CWE-778: Insufficient Logging
When a security-critical event occurs, the product either does not record the event or omits important details about the event when logging it.
How to prevent it
- Architecture and Design: Use a centralized logging mechanism that supports multiple levels of detail.
- Implementation: Ensure that all security-related successes and failures can be logged. When storing data in the cloud (e.g., AWS S3 buckets, Azure blobs, Google Cloud Storage, etc.), use the provider's controls to enable and capture detailed logging information.
- Operation: Be sure to set the level of logging appropriately in a production environment. Sufficient data should be logged to enable system administrators to detect attacks, diagnose errors, and recover from attacks. At the same time, logging too much data (CWE-779) can cause the same problems, including unexpected costs when using a cloud environment.
- Operation: To enable storage logging using Azure's Portal, navigate to the name of the Storage Account, locate Monitoring (CLASSIC) section, and select Diagnostic settings (classic). For each of the various properties (blob, file, table, queue), ensure the status is properly set for the desired logging data. If using PowerShell, the Set-AzStorageServiceLoggingProperty command could be called using appropriate -ServiceType, -LoggingOperations, and -RetentionDays arguments.
References
Advisories
Packages
Other links
- github.com/FriendsOfPHP/security-advisories/blob/master/magento/magento1ce/CVE-…
- github.com/FriendsOfPHP/security-advisories/blob/master/magento/magento1ee/CVE-…
- github.com/FriendsOfPHP/security-advisories/blob/master/magento/product-communi…
- magento.com/security/patches/magento-2.3.3-and-2.2.10-security-update
- web.archive.org/web/20211209030216/https://magento.com/security/patches/supee-11219
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-wh92-6q6g-px7j Magento Community Edition Improper Input Validation vulnerability | Critical Known exploited | Also affects magento/community-edition |
| GHSA-m8cj-3v68-3cxj Magento Open Source affected by an Improper Restriction of XML External Entity Reference ('XXE') vulnerability | Critical Known exploited | Also affects magento/community-edition |
| GHSA-f8fv-f786-9933 Magento improper input validation vulnerability | Critical Known exploited | Also affects magento/community-edition |
| GHSA-qvwr-p3hj-j6jf Magento vulnerable to privilege escalation due to incorrect authorization | Medium | Also affects magento/community-edition |
| GHSA-pcrx-r49h-x2w5 Magento vulnerable to stored Cross-Site Scripting (XSS) | Medium | Also affects magento/community-edition |
| GHSA-r355-75hw-r8jf Magento allows incorrect authorization | Medium | Also affects magento/community-edition |
| GHSA-2768-5wmv-cfff Magento vulnerable to stored Cross-Site Scripting (XSS) | High | Also affects magento/community-edition |
| GHSA-69x9-xp2j-w8g8 Magento provides incorrect authorization through a security feature bypass | High | Also affects magento/community-edition |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor