Fastly Magento2 sensitive information disclosure
Date: 2022-05
Affected: composer/fastly/magento2
Attack vector: info-disclosure
Category: vulnerability-disclosure
Severity: Medium
CVE: CVE-2017-13761
CWE: CWE-200
CVSS: 6.5 (CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N)

The Fastly CDN module before 1.2.26 for Magento2, when used with a third-party authentication plugin, might allow remote authenticated users to obtain sensitive information from authenticated sessions via vectors involving caching of redirect responses.


Mitigations:

Architectural layers (MAESTRO):