GitHub Advisoryadvisory · Packagist

GHSA-pfxv-66r9-4gqw Magento Insufficient authorization check when adding users to company accounts

MEDIUM Published 2022-05-24 Modified 2024-05-15 Official page ↗
Aliases
CVE-2019-7872
Ecosystem
Packagist
Packages
magento/community-edition
Severity
Moderate
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:N
Weaknesses
CWE-285
Reviewed
2024-05-15

Affected packages

• Packagist magento/community-edition: >= 2.1, < 2.1.18 → fixed in 2.1.18 • Packagist magento/community-edition: >= 2.2, < 2.2.9 → fixed in 2.2.9 • Packagist magento/community-edition: >= 2.3, < 2.3.2 → fixed in 2.3.2

Description

An insecure direct object reference (IDOR) vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 due to insufficient authorizations checks. This can be abused by a user with admin privileges to add users to company accounts or modify existing user details.

Related

Alias · CVE (1)

  • CVE-2019-7872 An insecure direct object reference (IDOR) vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3… vulnerability

Weakness · CWE (1)

  • CWE-285 Improper Authorization weakness

References