Description
A denial-of-service vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. Under certain conditions, an unauthenticated attacker could force the Magento store's full page cache to serve a 404 page to customers.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| — | Magento 2 | Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Packagist | magento/community-edition | >= 2.1.0, < 2.1.18 | 2.1.18 | GHSA-prw8-gqwp-f7fh |
| Packagist | magento/community-edition | >= 2.2.0, < 2.2.9 | 2.2.9 | GHSA-prw8-gqwp-f7fh |
| Packagist | magento/community-edition | >= 2.3.0, < 2.3.2 | 2.3.2 | GHSA-prw8-gqwp-f7fh |