deardaniel/secdata-raw huggingface dataset:
CVE: CVE-2021-41143
Published: 2023-01-27
Description: OpenMage LTS is an e-commerce platform. Prior to versions 19.4.22 and 20.0.19, Magento admin users with access to the customer media could execute code on the server. Versions 19.4.22 and 20.0.19 contain a patch for this issue.


CVSS Score: 7.2 (HIGH)
CWE: CWE-77, CWE-22
References: https://github.com/OpenMage/magento-lts/commit/45330ff50439984e806992fa22c3f96c4d660f91; https://github.com/OpenMage/magento-lts/releases/tag/v19.4.22; https://github.com/OpenMage/magento-lts/releases/tag/v20.0.19
CVE: CVE-2021-41144
Published: 2023-01-27
Description: OpenMage LTS is an e-commerce platform. Prior to versions 19.4.22 and 20.0.19, a layout block was able to bypass the block blacklist to execute remote code. Versions 19.4.22 and 20.0.19 contain a patch for this issue.



CVSS Score: 8.8 (HIGH)
CWE: CWE-77, CWE-77
References: https://github.com/OpenMage/magento-lts/commit/06c45940ba3256cdfc9feea12a3c0ca56d23acf8; https://github.com/OpenMage/magento-lts/releases/tag/v19.4.22; https://github.com/OpenMage/magento-lts/releases/tag/v20.0.19
CVE: CVE-2021-41231
Published: 2023-01-27
Description: OpenMage LTS is an e-commerce platform. Prior to versions 19.4.22 and 20.0.19, an administrator with the permissions to upload files via DataFlow and to create products was able to execute arbitrary code via the convert profile. Versions 19.4.22 and 20.0.19 contain a patch for this issue.



CVSS Score: 7.2 (HIGH)
CWE: CWE-77, CWE-434
References: https://github.com/OpenMage/magento-lts/commit/d16fc6c5a1e66c6f0d9f82020f11702a7ddd78e4; https://github.com/OpenMage/magento-lts/releases/tag/v19.4.22; https://github.com/OpenMage/magento-lts/releases/tag/v20.0.19
CVE: CVE-2023-0549
Published: 2023-01-27
Description: A vulnerability, which was classified as problematic, has been found in YAFNET up to 3.1.10. This issue affects some unknown processing of the file /forum/PostPrivateMessage of the component Private Message Handler. The manipulation of the argument subject/message leads to cross site scripting. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. Upgrading to version 3.1.11 is able to address this issue. The identifier of the patch is 2237a9d552e258a43570bb478a92a5505e7c8797. It is recommended to upgrade the affected component. The identifier VDB-219665 was assigned to this vulnerability.
CVSS Score: 3.5 (LOW)
CWE: CWE-79
References: https://drive.google.com/drive/folders/1ct6Tp_cnsYO8L_JSvlBCf_Ae7KW3JAcD?usp=sharing; https://github.com/YAFNET/YAFNET/commit/2237a9d552e258a43570bb478a92a5505e7c8797; https://github.com/YAFNET/YAFNET/releases/tag/v3.1.11
CVE: CVE-2022-32472
Published: 2023-01-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2022-32952
Published: 2023-01-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was withdrawn by its CNA. Further investigation showed that it was not a security issue. Notes: none.
CVE: CVE-2022-48116
Published: 2023-01-27
Description: AyaCMS v3.1.2 was discovered to contain a remote code execution (RCE) vulnerability via the component /admin/tpl_edit.inc.php.
CVSS Score: 7.2 (HIGH)
CWE: CWE-94
References: https://github.com/loadream/AyaCMS/issues/10; https://github.com/loadream/AyaCMS/issues/10
CVE: CVE-2022-48118
Published: 2023-01-27
Description: Jorani v1.0 was discovered to contain a cross-site scripting (XSS) vulnerability via the Acronym parameter.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://github.com/bbalet/jorani/issues/379; https://github.com/bbalet/jorani/issues/379
CVE: CVE-2019-25053
Published: 2023-01-27
Description: A path traversal vulnerability exists in Sage FRP 1000 before November 2019. This allows remote unauthenticated attackers to access files outside of the web tree via a crafted URL.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://www.on-x.com/wp-content/uploads/2023/01/on-x_-_security_advisory_-_sage_frp_1000_-_cve-2019-25053.pdf; https://www.on-x.com/wp-content/uploads/2023/01/on-x_-_security_advisory_-_sage_frp_1000_-_cve-2019-25053.pdf; https://www.on-x.com/wp-content/uploads/2023/01/on-x_-_security_advisory_-_sage_frp_1000_-_cve-2019-25053.pdf
CVE: CVE-2022-39380
Published: 2023-01-27
Description: Wire web-app is part of Wire communications. Versions prior to 2022-11-02 are subject to Improper Handling of Exceptional Conditions. In the wire-webapp, certain combinations of Markdown formatting can trigger an unhandled error in the conversion to HTML representation. The error makes it impossible to display the affected chat history, other conversations are not affected. The issue has been fixed in version 2022-11-02 and is already deployed on all Wire managed services. On-premise instances of wire-webapp need to be updated to docker tag 2022-11-02-production.0-v0.31.9-0-337e400 or wire-server 2022-11-03 (chart/4.26.0), so that their applications are no longer affected. As a workaround, you may use an iOS or Android client and delete the corresponding message from the history OR write 30 or more messages into the affected conversation to prevent the client from further rendering of the corresponding message. When attempting to retrieve messages from the conversation history, the error will continue to occur once the malformed message is part of the result.
CVSS Score: 5.3 (MEDIUM)
CWE: CWE-755
References: https://github.com/wireapp/wire-webapp/security/advisories/GHSA-v5mf-358q-w7m4; https://github.com/wireapp/wire-webapp/security/advisories/GHSA-v5mf-358q-w7m4
CVE: CVE-2022-48107
Published: 2023-01-27
Description: D-Link DIR_878_FW1.30B08 was discovered to contain a command injection vulnerability via the component /setnetworksettings/IPAddress. This vulnerability allows attackers to escalate privileges to root via a crafted payload.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://github.com/migraine-sudo/D_Link_Vuln/tree/main/cmd%20inject%20in%20IPAddress; https://www.dlink.com/en/security-bulletin/; https://github.com/migraine-sudo/D_Link_Vuln/tree/main/cmd%20inject%20in%20IPAddress
CVE: CVE-2022-48108
Published: 2023-01-27
Description: D-Link DIR_878_FW1.30B08 was discovered to contain a command injection vulnerability via the component /SetNetworkSettings/SubnetMask. This vulnerability allows attackers to escalate privileges to root via a crafted payload.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-78, CWE-78
References: https://github.com/migraine-sudo/D_Link_Vuln/tree/main/cmd%20inject%20in%20Netmask; https://www.dlink.com/en/security-bulletin/; https://github.com/migraine-sudo/D_Link_Vuln/tree/main/cmd%20inject%20in%20Netmask
CVE: CVE-2023-0550
Published: 2023-01-27
Description: The Quick Restaurant Menu plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 2.0.2. This is due to the fact that during menu item deletion/modification, the plugin does not verify that the post ID provided to the AJAX action is indeed a menu item. This makes it possible for authenticated attackers, with subscriber-level access or higher, to modify or delete arbitrary posts.
CVSS Score: 8.1 (HIGH)
CWE: CWE-639
References: https://plugins.trac.wordpress.org/browser/quick-restaurant-menu/tags/2.0.2/includes/admin/ajax-functions.php; https://plugins.trac.wordpress.org/changeset/2851871/quick-restaurant-menu/trunk?contextall=1&old=2788636&old_path=%2Fquick-restaurant-menu%2Ftrunk; https://www.wordfence.com/blog/2023/02/multiple-vulnerabilities-patched-in-quick-restaurant-menu-plugin/
CVE: CVE-2023-0553
Published: 2023-01-27
Description: The Quick Restaurant Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its settings parameters in versions up to, and including, 2.0.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disabled.
CVSS Score: 4.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://plugins.trac.wordpress.org/browser/quick-restaurant-menu/tags/2.0.2/includes/admin/settings/settings.php; https://plugins.trac.wordpress.org/changeset/2851871/quick-restaurant-menu/trunk?contextall=1&old=2788636&old_path=%2Fquick-restaurant-menu%2Ftrunk; https://www.wordfence.com/blog/2023/02/multiple-vulnerabilities-patched-in-quick-restaurant-menu-plugin/
CVE: CVE-2023-0554
Published: 2023-01-27
Description: The Quick Restaurant Menu plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0.2. This is due to missing or incorrect nonce validation on its AJAX actions. This makes it possible for unauthenticated attackers to update menu items, via forged request granted they can trick a site administrator into performing an action such as clicking on a link.
CVSS Score: 8.1 (HIGH)
CWE: CWE-352
References: https://plugins.trac.wordpress.org/browser/quick-restaurant-menu/tags/2.0.2/includes/admin/ajax-functions.php; https://plugins.trac.wordpress.org/changeset/2851871/quick-restaurant-menu/trunk?contextall=1&old=2788636&old_path=%2Fquick-restaurant-menu%2Ftrunk; https://www.wordfence.com/blog/2023/02/multiple-vulnerabilities-patched-in-quick-restaurant-menu-plugin/
CVE: CVE-2023-0555
Published: 2023-01-27
Description: The Quick Restaurant Menu plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on its AJAX actions in versions up to, and including, 2.0.2. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to invoke those actions intended for administrator use. Actions include menu item creation, update and deletion and other menu management functions. Since the plugin does not verify that a post ID passed to one of its AJAX actions belongs to a menu item, this can lead to arbitrary post deletion/alteration.
CVSS Score: 8.1 (HIGH)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/quick-restaurant-menu/tags/2.0.2/includes/admin/ajax-functions.php; https://plugins.trac.wordpress.org/changeset/2851871/quick-restaurant-menu/trunk?contextall=1&old=2788636&old_path=%2Fquick-restaurant-menu%2Ftrunk; https://www.wordfence.com/blog/2023/02/multiple-vulnerabilities-patched-in-quick-restaurant-menu-plugin/
CVE: CVE-2022-39811
Published: 2023-01-27
Description: Italtel NetMatch-S CI 5.2.0-20211008 has incorrect Access Control under NMSCI-WebGui/advancedsettings.jsp and NMSCIWebGui/SaveFileUploader. By not verifying permissions for access to resources, it allows an attacker to view pages that are not allowed, and modify the system configuration, bypassing all controls (without checking for user identity).
CVSS Score: 9.1 (CRITICAL)
CWE: CWE-862, CWE-862
References: https://www.gruppotim.it/it/footer/red-team.html; https://www.gruppotim.it/it/footer/red-team.html
CVE: CVE-2022-39812
Published: 2023-01-27
Description: Italtel NetMatch-S CI 5.2.0-20211008 allows Absolute Path Traversal under NMSCI-WebGui/SaveFileUploader. An unauthenticated user can upload files to an arbitrary path. An attacker can change the uploadDir parameter in a POST request (not possible using the GUI) to an arbitrary directory. Because the application does not check in which directory a file will be uploaded, an attacker can perform a variety of attacks that can result in unauthorized access to the server.
CVSS Score: 7.5 (HIGH)
CWE: CWE-22, CWE-22
References: https://www.gruppotim.it/it/footer/red-team.html; https://www.gruppotim.it/it/footer/red-team.html
CVE: CVE-2022-39813
Published: 2023-01-27
Description: Italtel NetMatch-S CI 5.2.0-20211008 allows Multiple Reflected/Stored XSS issues under NMSCIWebGui/j_security_check via the j_username parameter, or NMSCIWebGui/actloglineview.jsp via the name or actLine parameter. An attacker leveraging this vulnerability could inject arbitrary JavaScript. The payload would then be triggered every time an authenticated user browses the page containing it.
CVSS Score: 6.1 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://www.gruppotim.it/it/footer/red-team.html; https://www.gruppotim.it/it/footer/red-team.html
CVE: CVE-2022-43978
Published: 2023-01-27
Description: There is an improper authentication vulnerability in Pandora FMS v764. The application verifies that the user has a valid session when he is not trying to do a login. Since the secret is static in generatePublicHash function, an attacker with knowledge of a valid session can abuse this in order to pass the authentication check.
CVSS Score: 5.6 (MEDIUM)
CWE: CWE-287, CWE-798
References: https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/; https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/
CVE: CVE-2022-43979
Published: 2023-01-27
Description: There is a Path Traversal that leads to a Local File Inclusion in Pandora FMS v764. A function is called to check that the parameter that the user has inserted does not contain malicious characteres, but this check is insufficient. An attacker could insert an absolute path to overcome the heck, thus being able to incluse any PHP file that resides on the disk. The exploitation of this vulnerability could lead to a remote code execution.
CVSS Score: 5.9 (MEDIUM)
CWE: CWE-434, CWE-22
References: https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/; https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/
CVE: CVE-2022-43980
Published: 2023-01-27
Description: There is a stored cross-site scripting vulnerability in Pandora FMS v765 in the network maps editing functionality. An attacker could modify a network map, including on purpose the name of an XSS payload. Once created, if a user with admin privileges clicks on the edited network maps, the XSS payload will be executed. The exploitation of this vulnerability could allow an atacker to steal the value of the admin user´s cookie.
CVSS Score: 5.2 (MEDIUM)
CWE: CWE-352, CWE-79
References: https://github.com/Argonx21/CVE-2022-43980; https://pandorafms.com/en/security/common-vulnerabilities-and-exposures/; https://github.com/Argonx21/CVE-2022-43980
CVE: CVE-2022-46968
Published: 2023-01-27
Description: A stored cross-site scripting (XSS) vulnerability in /index.php?page=help of Revenue Collection System v1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into sent messages.
CVSS Score: 5.4 (MEDIUM)
CWE: CWE-79, CWE-79
References: https://cxsecurity.com/issue/WLB[PII_REDACTED]; https://packetstormsecurity.com/files/169917/Revenue-Collection-System-1.0-Cross-Site-Scripting-Authentication-Bypass.html; https://packetstormsecurity.com/files/169917/Revenue-Collection-System-1.0-Cross-Site-Scripting-Authentication-Bypass.html
CVE: CVE-2022-4201
Published: 2023-01-27
Description: A blind SSRF in GitLab CE/EE affecting all from 11.3 prior to 15.4.6, 15.5 prior to 15.5.5, and 15.6 prior to 15.6.1 allows an attacker to connect to local addresses when configuring a malicious GitLab Runner.
CVSS Score: 3.5 (LOW)
CWE: CWE-918, CWE-918
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-4201.json; https://gitlab.com/gitlab-org/gitlab/-/issues/30376; https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-4201.json
CVE: CVE-2022-4205
Published: 2023-01-27
Description: In Gitlab EE/CE before 15.6.1, 15.5.5 and 15.4.6 using a branch with a hexadecimal name could override an existing hash.
CVSS Score: 6.3 (MEDIUM)
CWE: CWE-843, CWE-843
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-4205.json; https://gitlab.com/gitlab-org/gitlab/-/issues/374082; https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-4205.json
CVE: CVE-2022-4255
Published: 2023-01-27
Description: An info leak issue was identified in all versions of GitLab EE from 13.7 prior to 15.4.6, 15.5 prior to 15.5.5, and 15.6 prior to 15.6.1 which exposes user email id through webhook payload.
CVSS Score: 4.3 (MEDIUM)
References: https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-4255.json; https://gitlab.com/gitlab-org/gitlab/-/issues/373819; https://gitlab.com/gitlab-org/cves/-/blob/master/2022/CVE-2022-4255.json
CVE: CVE-2023-0556
Published: 2023-01-27
Description: The ContentStudio plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on several functions in versions up to, and including, 1.2.5. This makes it possible for unauthenticated attackers to obtain the blog metadata (via the function cstu_get_metadata) that includes the plugin's contentstudio_token. Knowing this token allows for other interactions with the plugin such as creating posts in versions prior to 1.2.5, which added other requirements to posting and updating.
CVSS Score: 9.8 (CRITICAL)
CWE: CWE-862
References: https://plugins.trac.wordpress.org/browser/contentstudio/tags/1.2.1/contentstudio-plugin.php#L517; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2851006%40contentstudio%2Ftrunk&old=2844028%40contentstudio%2Ftrunk&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/52db8d41-859a-4d68-8b83-3d3af8f1bf64?source=cve
CVE: CVE-2023-0557
Published: 2023-01-27
Description: The ContentStudio plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 1.2.5. This could allow unauthenticated attackers to obtain a nonce needed for the creation of posts.
CVSS Score: 7.5 (HIGH)
CWE: CWE-200
References: https://plugins.trac.wordpress.org/browser/contentstudio/trunk/contentstudio-plugin.php#L709; https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=2851006%40contentstudio%2Ftrunk&old=2844028%40contentstudio%2Ftrunk&sfp_email=&sfph_mail=; https://www.wordfence.com/threat-intel/vulnerabilities/id/62eb136f-3cb0-40dc-a154-015a7fa1077b?source=cve
CVE: CVE-2023-0558
Published: 2023-01-27
Description: The ContentStudio plugin for WordPress is vulnerable to authorization bypass due to an unsecure token check that is susceptible to type juggling in versions up to, and including, 1.2.5. This makes it possible for unauthenticated attackers to execute functions intended for use by users with proper API keys.
CVSS Score: 8.2 (HIGH)
CWE: CWE-639
References: https://plugins.trac.wordpress.org/browser/contentstudio/trunk/contentstudio-plugin.php#L416; https://www.wordfence.com/threat-intel/vulnerabilities/id/c31828dc-ef94-4895-8395-a5d52a0a82bd?source=cve; https://plugins.trac.wordpress.org/browser/contentstudio/trunk/contentstudio-plugin.php#L416
CVE: CVE-2022-23552
Published: 2023-01-27
Description: Grafana is an open-source platform for monitoring and observability. Starting with the 8.1 branch and prior to versions 8.5.16, 9.2.10, and 9.3.4, Grafana had a stored XSS vulnerability affecting the core plugin GeoMap. The stored XSS vulnerability was possible because SVG files weren't properly sanitized and allowed arbitrary JavaScript to be executed in the context of the currently authorized user of the Grafana instance. 

An attacker needs to have the Editor role in order to change a panel to include either an external URL to a SVG-file containing JavaScript, or use the `data:` scheme to load an inline SVG-file containing JavaScript. This means that vertical privilege escalation is possible, where a user with Editor role can change to a known password for a user having Admin role if the user with Admin role executes malicious JavaScript viewing a dashboard.   

Users may upgrade to version 8.5.16, 9.2.10, or 9.3.4 to receive a fix.
CVSS Score: 7.3 (HIGH)
CWE: CWE-79
References: https://github.com/grafana/grafana/commit/1c8a50b36973bd59a1cc5f34c30de8a9a6a431f0; https://github.com/grafana/grafana/commit/8b574e22b53aa4c5a35032a58844fd4aaaa12f5f; https://github.com/grafana/grafana/commit/c022534e3848a5d45c0b3face23b43aa44e4400a
CVE: CVE-2022-39324
Published: 2023-01-27
Description: Grafana is an open-source platform for monitoring and observability. Prior to versions 8.5.16 and 9.2.8, malicious user can create a snapshot and arbitrarily choose the `originalUrl` parameter by editing the query, thanks to a web proxy. When another user opens the URL of the snapshot, they will be presented with the regular web interface delivered by the trusted Grafana server. The `Open original dashboard` button no longer points to the to the real original dashboard but to the attacker’s injected URL. This issue is fixed in versions 8.5.16 and 9.2.8.
CVSS Score: 6.7 (MEDIUM)
CWE: CWE-79
References: https://github.com/grafana/grafana/commit/239888f[PII_REDACTED]6bb3a9135a7294e88c0c74a; https://github.com/grafana/grafana/commit/d7dcea71ea763780dc286792a0afd560bff2985c; https://github.com/grafana/grafana/pull/60232
CVE: CVE-2023-0047
Published: 2023-01-27
Description: Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: This candidate was in a CNA pool that was not assigned to any issues during 2023. Notes: none.
CVE: CVE-2023-22737
Published: 2023-01-28
Description: wire-server provides back end services for Wire, a team communication and collaboration platform. Prior to version 2022-12-09, every member of a Conversation can remove a Bot from a Conversation due to a missing permissions check. Only Conversation admins should be able to remove Bots. Regular Conversations are not allowed to do so. The issue is fixed in wire-server 2022-12-09 and is already deployed on all Wire managed services. On-premise instances of wire-server need to be updated to 2022-12-09/Chart 4.29.0, so that their backends are no longer affected. There are no known workarounds.
CVSS Score: 6.5 (MEDIUM)
CWE: CWE-280, CWE-862
References: https://github.com/wireapp/wire-server/commit/494a6881f5895d4ed9e5d011455242be0d5e6223; https://github.com/wireapp/wire-server/pull/2870; https://github.com/wireapp/wire-server/releases/tag/v2022-12-09
CVE: CVE-2023-23616
Published: 2023-01-28
Description: Discourse is an open-source discussion platform. Prior to version 3.0.1 on the `stable` branch and 3.1.0.beta2 on the `beta` and `tests-passed` branches, when submitting a membership request, there is no character limit for the reason provided with the request. This could potentially allow a user to flood the database with a large amount of data. However it is unlikely this could be used as part of a DoS attack, as the paths reading back the reasons are only available to administrators. Starting in version 3.0.1 on the `stable` branch and 3.1.0.beta2 on the `beta` and `tests-passed` branches, a limit of 280 characters has been introduced for membership requests.
CVSS Score: 3.5 (LOW)
CWE: CWE-400
References: https://github.com/discourse/discourse/commit/3e0cc4a5d9ef44ad902f6985d046ebb32f0a14ee; https://github.com/discourse/discourse/commit/d5745d34c20c31a221039d8913f[PII_REDACTED]3ea; https://github.com/discourse/discourse/pull/19993
CVE: CVE-2023-23617
Published: 2023-01-28
Description: OpenMage LTS is an e-commerce platform. Versions prior to 19.4.22 and 20.0.19 contain an infinite loop in malicious code filter in certain conditions. Versions 19.4.22 and 20.0.19 have a fix for this issue. There are no known workarounds.
CVSS Score: 4.9 (MEDIUM)
CWE: CWE-835
References: https://github.com/OpenMage/magento-lts/commit/494027785bdb7db53e60c11ef03c144b61cd3172; https://github.com/OpenMage/magento-lts/releases/tag/v19.4.22; https://github.com/OpenMage/magento-lts/releases/tag/v20.0.19