CVE-2023-41879 Magento LTS's guest order "protect code" can be brute-forced too easily

What is CVE-2023-41879?

CVE-2023-41879 is a high-severity vulnerability in OpenMage magento-lts, published on 11 Sep 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Magento LTS is the official OpenMage LTS codebase. Guest orders may be viewed without authentication using a "guest-view" cookie which contains the order's "protect_code". This code is 6 hexadecimal characters which is arguably not enough to prevent a brute-force attack. Exposing each order would require a separate brute force attack. This issue has been patched in versions 19.5.1 and 20.1.1.

Weakness: CWE-330

Which versions are affected by CVE-2023-41879?

4 open source packages ship an affected version, including openmage/magento-lts. It affects 1 product.

Products include Openmage Magento.

How do I fix CVE-2023-41879?

Upgrade openmage/magento-lts to a fixed version for your release line: 19.5.1 or 20.1.1.

Is CVE-2023-41879 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2023-41879 exists.

Other vulnerabilities in OpenMage magento-lts

• CVE-2021-21426 Fixes a bug in Zend Framework's Stream HTTP Wrapper Critical 9.8
• CVE-2021-21427 Backport for CVE-2021-21024 Blind SQLi from Magento 2 Critical 9.1
• CVE-2021-41144 OpenMage LTS authenticated remote code execution through layout update High 8.8
• CVE-2026-40488 OpenMage LTS has Customer File Upload Extension Blocklist Bypass that Leads to Remote Code Execution High 8.7
• CVE-2026-25524 OpenMage LTS's Phar Deserialization leads to Remote Code Execution High 8.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-9358-cpvx-c2qp.