CVE-2018-5301: Magento Cross-Site Request Forgery (CSRF)
Summary
CVE-2018-5301: Magento Cross-Site Request Forgery (CSRF). Affects magento/community-edition across 2 version ranges.
< 2.0.10
>= 2.1.0, < 2.1.2
Fixed in 2.0.10 or 2.1.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Magento is an open-source e-commerce platform used for building online stores. It offers a wide range of features for managing products, orders, customer data, and more. However, versions before 2.0.10 and 2.1.x before 2.1.2 are vulnerable to Cross-Site Request Forgery (CSRF) attacks. This vulnerability allows an attacker to delete a customer address from an address book without proper authorization.
Vulnerability Detail
The CSRF vulnerability in Magento allows an attacker to trick a logged-in user into performing unintended actions. By crafting a malicious request and tricking the user into clicking on a specially crafted link or visiting a malicious website, the attacker can delete a customer address from the address book. This can lead to loss of important customer data and disrupt the functionality of the affected Magento installation.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 2.0.102.0.10composer require magento/community-edition:2.0.10 -
>= 2.1.0, < 2.1.22.1.2composer require magento/community-edition:2.1.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading to the patched versions of Magento.
Conclusion
The CSRF vulnerability in Magento can have serious consequences, including the unauthorized deletion of customer addresses. It is crucial to apply the recommended fix by upgrading to the patched versions of Magento. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for magento/community-edition →
FAQ
A CSRF (Cross-Site Request Forgery) attack is a type of security vulnerability where an attacker tricks a user into performing unintended actions on a website or web application.
The CSRF vulnerability in Magento can result in the unauthorized deletion of customer addresses from the address book. This can lead to data loss and disrupt the functionality of the affected Magento installation.
You can use Vulert's playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the composer.lock file.
Yes, patches are available for this vulnerability. It is recommended to upgrade to Magento Community Edition 2.0.10 or later, or Magento Enterprise Edition 2.1.2 or later.
You can find more information about this vulnerability in the GitHub Advisory Database: [link to the advisory]
References
Related vulnerabilities
Recent vulnerabilities recorded for magento/community-edition.
