CVE-2023-41879: openmage magento Use of Insufficiently Random Values

Vulnerability summary

CVE-2023-41879 is a high (CVSS 7.5) Use of Insufficiently Random Values vulnerability in openmage magento. EPSS estimates a 1.25% chance of exploitation in the next 30 days, higher than 69.2% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 11-09-2023
   PublishedVulnerability first disclosed.
2. 26-09-2024
   Last modifiedVulnerability information updated.

Description

Magento LTS is the official OpenMage LTS codebase. Guest orders may be viewed without authentication using a "guest-view" cookie which contains the order's "protect_code". This code is 6 hexadecimal characters which is arguably not enough to prevent a brute-force attack. Exposing each order would require a separate brute force attack. This issue has been patched in versions 19.5.1 and 20.1.1.

• CWE-330Use of Insufficiently Random ValuesThe product uses insufficiently random numbers or values in a security context that depends on unpredictable numbers.