CVE-2019-7874: Cross-Site Request Forgery (CSRF)

May 24, 2022 (updated July 17, 2023)

A cross-site request forgery vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can result in unintended deletion of user roles.

References

github.com/advisories/GHSA-8v75-8jj8-77gf
nvd.nist.gov/vuln/detail/CVE-2019-7874
web.archive.org/web/20211206084839/https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13

Detect and mitigate CVE-2019-7874 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →