#VU30929 Information disclosure in Magento Open Source - CVE-2019-7929
Published: August 3, 2019 / Updated: July 17, 2020
Vulnerability identifier: #VU30929
Vulnerability risk: Medium
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: CVE-2019-7929
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
Magento Open Source
Magento Open Source
Software vendor:
Adobe
Adobe
Description
The vulnerability allows a remote privileged user to gain access to sensitive information.
An information leakage vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An authenticated user with administrator privileges may be able to view metadata of a trusted device used by another administrator via a crafted http request.
Remediation
Install update from vendor's website.