GHSA-7g5j-q8qj-8984
Magento Insecure Direct Object Reference (IDOR) vulnerability
At a glance
- Published
- Updated
- CVE
- CVE-2019-7925
- CVSS_V3
- CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
Description
An insecure direct object reference (IDOR) vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can be exploited by an administrator with limited privileges to delete the downloadable products folder.
Affected packages
| Package | Versions |
|---|---|
| Packagist · magento/community-edition | introduced 2.1, fixed 2.1.18 |
| Packagist · magento/community-edition | introduced 2.2, fixed 2.2.9 |
| Packagist · magento/community-edition | introduced 2.3, fixed 2.3.2 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2019-7925 ADVISORY
- https://github.com/FriendsOfPHP/security-advisories/blob/master/magento/product-community-edition/CVE-2019-7925.yaml WEB
- https://github.com/magento/magento2 PACKAGE
- https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |