VYPR
← All advisories
High severity7.5NVD Advisory· Published Nov 5, 2019· Updated Jun 17, 2026

CVE-2019-8116

CVE-2019-8116

Description

Insecure authentication and session management vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An unauthenticated user can leverage a guest session id value following a successful login to gain access to customer account index page.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected products

6
  • Magento/Magento5 versions
    cpe:2.3:a:magento:magento:*:*:*:*:commerce:*:*:*+ 4 more
    • cpe:2.3:a:magento:magento:*:*:*:*:commerce:*:*:*range: >=2.2.0,<2.2.10
    • cpe:2.3:a:magento:magento:*:*:*:*:open_source:*:*:*range: >=2.2.0,<2.2.10
    • cpe:2.3:a:magento:magento:2.3.2:-:*:*:commerce:*:*:*
    • cpe:2.3:a:magento:magento:2.3.2:-:*:*:open_source:*:*:*
    • (no CPE)range: <2.2.10, <2.3.3, <2.3.2-p1
  • Adobe Inc./Magento 1& 2cpe-rescue
    Range: Magento 2.2 prior to 2.2.10

Patches

Vulnerability mechanics

References

1

News mentions

0

No linked articles in our index yet.