CVE-2019-7849 addresses an inadequate session validation vulnerability in Magento, specifically impacting Magento 1.x, Magento Commerce, Magento 2.1, Magento 2.2, and Magento 2.3 versions prior to their respective patched releases. This vulnerability carries a CVSS score of 7.5 (HIGH), indicating a network-exploitable flaw with low attack complexity that could lead to high integrity impact without requiring user interaction or privileges. There is no evidence of active exploitation, publicly available exploit code (Metasploit, Nuclei, ExploitDB), or inclusion in the CISA KEV catalog, though it has received some community and media attention.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 1.14.4.2CPE matchmatch criteria | cpe:2.3:a:magento:magento:*:*:*:*:commerce:*:*:* | ||
>= 1.0.0, < 1.9.4.2CPE matchmatch criteria | cpe:2.3:a:magento:magento:*:*:*:*:open_source:*:*:* | ||
>= 2.1.0, < 2.1.18CPE matchmatch criteria | cpe:2.3:a:magento:magento:*:*:*:*:open_source:*:*:* | ||
>= 2.2.0, < 2.2.9CPE matchmatch criteria | cpe:2.3:a:magento:magento:*:*:*:*:open_source:*:*:* | ||
>= 2.3.0, < 2.3.2CPE matchmatch criteria | cpe:2.3:a:magento:magento:*:*:*:*:open_source:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
No social media mentions found for this CVE.
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.