{"action":"Upgrade openmage/magento-lts to 19.5.1 or later.","affected":[{"fixed":"19.5.1","introduced":"0"},{"fixed":"20.1.1","introduced":"20.0.0"}],"component":"openmage/magento-lts","cve_ids":["CVE-2023-41879"],"ecosystem":"Packagist","epss":0.01252,"exploited":false,"fixed_versions":["19.5.1","20.1.1"],"ghsa_id":"GHSA-9358-cpvx-c2qp","id":"tcs_01M5KEZHS68Z6A2DB18CZGNXVC","modified_at":"2024-02-16T07:56:56.452127Z","published_at":"2023-09-11T20:45:02Z","references":["https://osv.dev/vulnerability/GHSA-9358-cpvx-c2qp","https://github.com/OpenMage/magento-lts/security/advisories/GHSA-9358-cpvx-c2qp","https://nvd.nist.gov/vuln/detail/CVE-2023-41879","https://github.com/OpenMage/magento-lts/commit/2a2a2fb504247e8966f8ffc2e17d614be5d43128","https://github.com/OpenMage/magento-lts/commit/31e74ac5d670b10001f88f038046b62367f15877","https://github.com/OpenMage/magento-lts","https://github.com/OpenMage/magento-lts/releases/tag/v19.5.1","https://github.com/OpenMage/magento-lts/releases/tag/v20.1.1"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-9358-cpvx-c2qp","url":"https://osv.dev/vulnerability/GHSA-9358-cpvx-c2qp"}],"summary":"Magento LTS's guest order \"protect code\" can be brute-forced too easily"}