Vulnerability advisory

GHSA-hpxv-vpfv-7jc9

Magento 2 Community Edition IDOR Vulnerability

Published May 24, 2022Updated Feb 16, 2024OSV record ↗

Also known as CVE-2019-7854

Severity

CVSS 3.xCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Affected versions

magento/community-edition Packagist

All magento/community-edition advisories →

Affected	Fixed in
`2.1.0` to before 2.1.18	`2.1.18`Advisories →
Also listed as affected (18) `2.1.0` `2.1.1` `2.1.10` `2.1.11` `2.1.12` `2.1.13` `2.1.14` `2.1.15` `2.1.16` `2.1.17` `2.1.2` `2.1.3` `2.1.4` `2.1.5` `2.1.6` `2.1.7` `2.1.8` `2.1.9`
`2.2.0` to before 2.2.9	`2.2.9`Advisories →
Also listed as affected (9) `2.2.0` `2.2.1` `2.2.2` `2.2.3` `2.2.4` `2.2.5` `2.2.6` `2.2.7` `2.2.8`
`2.3.0` to before 2.3.2	`2.3.2`Advisories →
Also listed as affected (2) `2.3.0` `2.3.1`

Description

An insecure direct object reference (IDOR) vulnerability in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 can lead to unauthorized disclosure of company credit history details.

GHSA-hpxv-vpfv-7jc9

Affected versions

magento/community-edition Packagist

Description

References