{"id":"CVE-2019-7860","aliases":["EUVD-2022-3238","GHSA-8v9h-m7pj-hx7c"],"status":"published","title":"Magento 2 Community Edition Weak PRNG","description":"A cryptographically weak pseudo-rando number generator is used in multiple security relevant contexts in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2.","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.01186,"percentile":0.68058,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-338"],"published":"2019-08-02T21:13:27Z","modified":"2026-10-24T10:31:00Z","fixes":[{"ecosystem":"Packagist","package":"magento/community-edition","fixed_in":["2.1.18","2.2.9","2.3.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"magento/community-edition","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.0"},{"fixed":"2.1.18"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"magento/community-edition","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.0"},{"fixed":"2.2.9"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"magento/community-edition","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.0"},{"fixed":"2.3.2"}]}]},{"source":"osv","ecosystem":"Packagist","package":"magento/community-edition","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.0"},{"fixed":"2.1.18"}]}],"versions":["2.1.0","2.1.1","2.1.10","2.1.11","2.1.12","2.1.13","2.1.14","2.1.15","2.1.16","2.1.17","2.1.2","2.1.3","2.1.4","2.1.5","2.1.6","2.1.7","2.1.8","2.1.9"]},{"source":"osv","ecosystem":"Packagist","package":"magento/community-edition","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.0"},{"fixed":"2.2.9"}]}],"versions":["2.2.0","2.2.1","2.2.2","2.2.3","2.2.4","2.2.5","2.2.6","2.2.7","2.2.8"]},{"source":"osv","ecosystem":"Packagist","package":"magento/community-edition","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.0"},{"fixed":"2.3.2"}]}],"versions":["2.3.0","2.3.1"]}],"products":[{"vendor":"adobe systems incorporated","product":"magento 2"},{"vendor":"magento","product":"magento"}],"references":[{"url":"https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-33","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-7860","tags":["advisory"]},{"url":"https://web.archive.org/web/20220121011306/https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-33","tags":["web"]},{"url":"https://github.com/FriendsOfPHP/security-advisories/blob/master/magento/product-community-edition/CVE-2019-7860.yaml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-8v9h-m7pj-hx7c"},{"url":"https://github.com/magento/magento2","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2019-7860","description":"A cryptographically weak pseudo-rando number generator is used in multiple security relevant contexts in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2.","status":"published","published":"2019-08-02T21:13:27Z","modified":"2024-08-04T21:02:19.17Z","updated_at":"2026-11-02T14:32:22.854093Z"}],"euvd":[{"id":"EUVD-2022-3238","description":"A cryptographically weak pseudo-rando number generator is used in multiple security relevant contexts in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2.","status":"published","published":"2019-08-02T21:13:27Z","modified":"2024-08-04T21:02:19Z","updated_at":"2026-11-03T03:06:44.425478Z"}],"ghsa":[{"id":"GHSA-8v9h-m7pj-hx7c","title":"Magento 2 Community Edition Weak PRNG","description":"A cryptographically weak pseudo-rando number generator is used in multiple security relevant contexts in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2.","status":"published","published":"2022-05-24T16:52:23Z","modified":"2024-02-12T11:46:03Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-338"],"updated_at":"2026-11-02T14:37:37.394986Z"}],"nvd":[{"id":"CVE-2019-7860","description":"A cryptographically weak pseudo-rando number generator is used in multiple security relevant contexts in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2.","status":"published","published":"2019-08-02T22:15:15.237Z","modified":"2026-06-17T02:41:08.46Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-338"],"updated_at":"2026-11-02T14:05:21.892729Z"}],"osv":[{"id":"CVE-2019-7860","description":"A cryptographically weak pseudo-rando number generator is used in multiple security relevant contexts in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2.","status":"published","published":"2019-08-02T22:15:15.237Z","modified":"2026-10-24T10:31:00.799996326Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:12.974481Z"},{"id":"GHSA-8v9h-m7pj-hx7c","title":"Magento 2 Community Edition Weak PRNG","description":"A cryptographically weak pseudo-rando number generator is used in multiple security relevant contexts in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2.","status":"published","published":"2022-05-24T16:52:23Z","modified":"2024-02-16T08:05:22.128937Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-338"],"updated_at":"2026-11-02T15:46:42.78452Z"}]}}