CVE-2015-8707: Magento

Critical severity, CVSS 9.8. EPSS: 1.3% chance of exploitation in the next 30 days.

Password reset tokens in Magento CE before 1.9.2.2, and Magento EE before 1.14.2.2 are passed via a GET request and not canceled after use, which allows remote attackers to obtain user passwords via a crafted external service with access to the referrer field.

Affected products

• Magento Magento: up to and including 1.9.2.1; up to and including 1.14.2.1

Published 2017-09-26. Last modified 2026-06-17.