Magento 2.3.2, 2.2.9 and 2.1.18 Security Update 3/3

An authenticated user with privileges to create email templates can leak sensitive data through malicious email template code.

An authenticated user with full admin privileges can create two factor settings that can be abused by low privileged user to leak sensitive data via crafted user form component.

Inadequate validation can lead to disclosure of product names even if marked as disabled.

An insufficiently robust anti-CSRF token implementation could be abused to add unwanted items to a shopper's cart.

An attacker can delete the store design schedule within the context of an authenticated administrator's session through cross-site request forgery.

An attacker can delete all blocks causing the loss of data from customer pages within the context of an authenticated administrator's session.

Cryptographically weak pseudo-rando number generator is used in multiple security relevant contexts (e.g., anti-CSRF tokens) allowing malicious user to predict random values.

An Insecure Direct Object Reference (IDOR) vulnerability in the RSS feeds functionality can lead to unauthorized access to order details.

Cryptographically weak pseudo-rando number generator and insecure block cipher mode is used to generate intialization vector in multiple security relevant contexts.

Insufficient brute force protections on promo code entry could allow an attacker to guess discount codes offered by the Magento merchant.

Requests for a specific file path could result in a redirect to the URL of the Magento admin panel, disclosing its location to potentially unauthorized parties.

A defense-in-depth check was added to mitigate inadequate session validation handling by 3rd party checkout modules.

A cross-site request forgery vulnerability exists in the GiftCardAccount removal feature

A cross-site request forgery vulnerability exists in the checkout cart item. This could be exploited at the time of editing or configuration.

An authenticated user with admin privileges to edit certain configuration keys can bypass a file extension filter by allowing uploads of executable file extensions.