CVE-2015-8707 Password reset tokens in Magento CE before 1.9.2.2, and Magento EE before 1.14.2.2 are passed via a GET request and not canceled after use, which allows remote attackers to obtain user passwords via a...
CriticalCVSS 9.8
EPSS 1.3%
- Published
- Updated
- Exploit status
- No public exploit known
Description
Password reset tokens in Magento CE before 1.9.2.2, and Magento EE before 1.14.2.2 are passed via a GET request and not canceled after use, which allows remote attackers to obtain user passwords via a crafted external service with access to the referrer field.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| magento | <= 1.9.2.1 | No fix listed |
| magento | <= 1.14.2.1 | No fix listed |
References
- magento.com vendor-advisory