CVE-2019-8116

Name of the Vulnerable Software and Affected Versions Magento 2.2 prior to 2.2.10 Magento 2.3 prior to 2.3.3 or 2.3.2-p1

Description The issue is related to insecure authentication and session management. An unauthenticated user can exploit a guest session id value following a successful login to gain access to the customer account index page.

Recommendations For Magento 2.2 prior to 2.2.10, update to version 2.2.10 or later. For Magento 2.3 prior to 2.3.3 or 2.3.2-p1, update to version 2.3.3 or 2.3.2-p1 or later.