GitHub Advisoryadvisory · Packagist

GHSA-3pgc-7jf3-5x5g Magento 2 Community Edition IDOR Vulnerability

HIGH Published 2022-05-24 Modified 2024-02-12 Official page ↗
Aliases
CVE-2019-7890
Ecosystem
Packagist
Packages
magento/community-edition
Severity
High
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Weaknesses
CWE-639
Reviewed
2023-07-17

Affected packages

• Packagist magento/community-edition: >= 2.1, < 2.1.18 → fixed in 2.1.18 • Packagist magento/community-edition: >= 2.2, < 2.2.9 → fixed in 2.2.9 • Packagist magento/community-edition: >= 2.3, < 2.3.2 → fixed in 2.3.2

Description

An Insecure Direct Object Reference (IDOR) vulnerability exists in the order processing workflow of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can lead to unauthorized access to order details.

Related

Alias · CVE (1)

  • CVE-2019-7890 An Insecure Direct Object Reference (IDOR) vulnerability exists in the order processing workflow of Magento 2.1 prior to 2.1.18, Magento… vulnerability

Weakness · CWE (1)

  • CWE-639 Authorization Bypass Through User-Controlled Key weakness

References