magento/magento2 · Security
Magento 2 Community Edition IDOR Vulnerability
- GHSA ID
- GHSA-hpxv-vpfv-7jc9
- CVE ID
- CVE-2019-7854
- Severity
- high
- Published
- Updated
- CVSS
- 7.5 · CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
- CVSS v3
- 7.5 · CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Description
An insecure direct object reference (IDOR) vulnerability in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 can lead to unauthorized disclosure of company credit history details.
CWEs
- CWE-639 · Authorization Bypass Through User-Controlled Key
References
- https://nvd.nist.gov/vuln/detail/CVE-2019-7854 ↗
- https://web.archive.org/web/20220121051916/https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23 ↗
- https://github.com/FriendsOfPHP/security-advisories/blob/master/magento/product-community-edition/CVE-2019-7854.yaml ↗
- https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23 ↗
- https://github.com/advisories/GHSA-hpxv-vpfv-7jc9 ↗