The Fastly CDN module before 1.2.26 for Magento2, when used with a third-party…
Priority LOW 31CWE-200Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- Low
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- High · None · None
- Fix status
- Fixed
Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-200.
Summary
The Fastly CDN module before 1.2.26 for Magento2, when used with a third-party authentication plugin, might allow remote authenticated users to obtain sensitive information from authenticated sessions via vectors involving caching of redirect responses.
Why it matters now
EPSS 0.01222 68th percentileScored 2026-11-07
Fix Fixed fastly/magento2 (Packagist): 1.2.26
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | fastly/magento2 (Packagist) | before 1.2.26 | 1.2.26 | Patch available | GHSA-vpq9-c67q-23fq |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- fastly/magento2 (Packagist) Vendor— Affected before 1.2.26 Fixed in 1.2.26 Patch available GHSA-vpq9-c67q-23fq
Remediation
- Fix · GHSA-vpq9-c67q-23fq fastly/magento2 (Packagist) Fixed in 1.2.26 Advisory →
Timeline
- 2026-10-02 Threatist record created from CVE-2017-13761
- 2026-10-03 Alias added: GHSA-vpq9-c67q-23fq
References
More Fastly vulnerabilities
- TI-2015-08022 Fastly Plugin api.php post cross site scripting CVSS 3.1MEDIUM 6.1
Sources
- CVE-2017-13761 · CVE Program
- CVE-2017-13761 · NVD
- FIRST EPSS
- GHSA-vpq9-c67q-23fq · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences