GitHub Advisoryadvisory · Packagist

GHSA-c33v-23rx-7qqc Magento 2 Community Edition IDOR Vulnerability

MEDIUM Published 2022-05-24 Modified 2024-02-12 Official page ↗
Aliases
CVE-2019-7864
Ecosystem
Packagist
Packages
magento/community-edition
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-639
Reviewed
2023-07-17

Affected packages

• Packagist magento/community-edition: >= 2.1.0, < 2.1.18 → fixed in 2.1.18 • Packagist magento/community-edition: >= 2.2.0, < 2.2.9 → fixed in 2.2.9 • Packagist magento/community-edition: >= 2.3.0, < 2.3.2 → fixed in 2.3.2

Description

An insecure direct object reference (IDOR) vulnerability exists in the RSS feeds of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can lead to unauthorized access to order details.

Related

Alias · CVE (1)

  • CVE-2019-7864 An insecure direct object reference (IDOR) vulnerability exists in the RSS feeds of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to… vulnerability

Weakness · CWE (1)

  • CWE-639 Authorization Bypass Through User-Controlled Key weakness

References