A denial-of-service vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. Under certain conditions, an unauthenticated attacker could force the Magento stores full page cache to serve a 404 page to customers.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Magento | Magento | 2.1.0 (including) | 2.1.18 (excluding) |
| Magento | Magento | 2.2.0 (including) | 2.2.9 (excluding) |
| Magento | Magento | 2.3.0 (including) | 2.3.2 (excluding) |