GHSA-7g5j-q8qj-8984
Magento Insecure Direct Object Reference (IDOR) vulnerability
En bref
- Publiée
- Mise à jour
- CVE
- CVE-2019-7925
- CVSS_V3
- CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N
Description
An insecure direct object reference (IDOR) vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can be exploited by an administrator with limited privileges to delete the downloadable products folder.
Paquets affectés
| Paquet | Versions |
|---|---|
| Packagist · magento/community-edition | introduced 2.1, fixed 2.1.18 |
| Packagist · magento/community-edition | introduced 2.2, fixed 2.2.9 |
| Packagist · magento/community-edition | introduced 2.3, fixed 2.3.2 |
Références
- https://nvd.nist.gov/vuln/detail/CVE-2019-7925 ADVISORY
- https://github.com/FriendsOfPHP/security-advisories/blob/master/magento/product-community-edition/CVE-2019-7925.yaml WEB
- https://github.com/magento/magento2 PACKAGE
- https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23 WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |