CVE-2016-2212
The getOrderByStatusUrlKey function in the Mage_Rss_Helper_Order class in app/code/core/Mage/Rss/Helper/Order.php in Magento Enterprise Edition before 1.14.2.3 and Magento Community Edition before 1.9.2.3 allows remote attackers to obtain sensitive…
Does this matter?
Lower severity and a low EPSS score (2.69%). Track it; it rarely justifies an emergency change on its own.
Description
The getOrderByStatusUrlKey function in the Mage_Rss_Helper_Order class in app/code/core/Mage/Rss/Helper/Order.php in Magento Enterprise Edition before 1.14.2.3 and Magento Community Edition before 1.9.2.3 allows remote attackers to obtain sensitive order information via the order_id in a JSON object in the data parameter in an RSS feed request to index.php/rss/order/status.
- CVSS 3.0
- 5.3 MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
- EPSS
- 2.69% probability · 85th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-200
- Affected
- magento/magento
- Source
- cve@mitre.org
References
- http://karmainsecurity.com/KIS-2016-02Exploit
- http://packetstormsecurity.com/files/135941/Magento-1.9.2.2-RSS-Feed-Information-Disclosure.htmlExploit
- http://seclists.org/fulldisclosure/2016/Feb/105
- http://www.securityfocus.com/archive/1/537601/100/0/threaded
- https://magento.com/security/patches/supee-7405Patch, Vendor Advisory
- http://karmainsecurity.com/KIS-2016-02Exploit
- http://packetstormsecurity.com/files/135941/Magento-1.9.2.2-RSS-Feed-Information-Disclosure.htmlExploit
- http://seclists.org/fulldisclosure/2016/Feb/105
- http://www.securityfocus.com/archive/1/537601/100/0/threaded
- https://magento.com/security/patches/supee-7405Patch, Vendor Advisory
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.