Description
OpenMage magento-lts before 20.19.0 and 21.0.0-beta1 before 21.0.0-beta3 contains a race condition in shopping cart price rule usage limits, because Mage_SalesRule_Model_Validator checks coupon limits without locking and the usage counters are later incremented non-atomically. Unauthenticated attackers, including guest shoppers, can submit concurrent checkouts to redeem a limited coupon more times than its cap allows.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| OpenMage | magento-lts | < 20.19.0, 21.0.0-beta1 – < 21.0.0-beta3 | 20.19.0 |
References
- GitHub Security Advisory (GHSA-5rg7-22cv-c9q6) vendor-advisory
- Patch Commit patch
- VulnCheck Advisory: OpenMage magento-lts before 20.19.0 Race Condition in Coupon Usage Limits third-party-advisory