GHSA-8mwx-wpp4-5xh4
GitHub Security Advisory
Magento Broken authentication and session managememt
✓ GitHub Reviewed
CRITICAL
Has CVE
Advisory Details
Insecure authentication and session management vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An unauthenticated user can append arbitrary session id that will not be invalidated by subsequent authentication.
Affected Packages
Packagist
magento/community-edition
Affected versions:
2.2
(fixed in 2.2.10)
Packagist
magento/community-edition
Affected versions:
2.3
(fixed in 2.3.2-p1)
Related CVEs
Key Information
9.0
/10
Dataset
Last updated: July 2, 2025 6:13 AM
Data from GitHub Advisory Database. This information is provided for research and educational purposes.