CVE-2015-8707 Information disclosure in n/a

What is CVE-2015-8707?

CVE-2015-8707 is a critical vulnerability in Magento Magento, published on 25 Sep 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Password reset tokens in Magento CE before 1.9.2.2, and Magento EE before 1.14.2.2 are passed via a GET request and not canceled after use, which allows remote attackers to obtain user passwords via a crafted external service with access to the referrer field.

Weakness: CWE-200

Which versions are affected by CVE-2015-8707?

It affects 1 product.

Products include Magento Magento.

How do I fix CVE-2015-8707?

No fix has been published for CVE-2015-8707 yet. Limit exposure of the affected software until one is available.

Is CVE-2015-8707 being exploited?

There is no known exploitation of CVE-2015-8707 in the wild and no public exploit code.

Other vulnerabilities in Magento Magento

• CVE-2020-9664 Magento php object injection vulnerability Critical 9.8
• CVE-2020-9576 Magento command injection vulnerability Critical 9.8
• CVE-2020-9578 Magento command injection vulnerability Critical 9.8
• CVE-2020-9579 Magento Security mitigation bypass vulnerability Critical 9.8
• CVE-2020-9580 Magento Security mitigation bypass vulnerability Critical 9.8

All Magento Magento vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-fq56-2x8j-2w4x.