GHSA-7g5j-q8qj-8984MediumCVSS 4.9

Magento Insecure Direct Object Reference (IDOR) vulnerability

Published
May 24, 2022
Last Modified
May 15, 2024

🔗 CVE IDs covered (1)

CVE-2019-7925 →

📋 Description

An insecure direct object reference (IDOR) vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can be exploited by an administrator with limited privileges to delete the downloadable products folder.

🎯 Affected products3

  • composer/magento/community-edition:>= 2.1, < 2.1.18
  • composer/magento/community-edition:>= 2.2, < 2.2.9
  • composer/magento/community-edition:>= 2.3, < 2.3.2

🔗 References (4)