Vulnerability advisory

GHSA-7g5j-q8qj-8984

Magento Insecure Direct Object Reference (IDOR) vulnerability

Published May 24, 2022Updated May 19, 2024OSV record ↗

Also known as CVE-2019-7925

Severity

CVSS 3.xCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N

Affected versions

magento/community-edition Packagist

All magento/community-edition advisories →

Affected	Fixed in
`2.1` to before 2.1.18	`2.1.18`Advisories →
Also listed as affected (21) `2.1.0` `2.1.0-rc1` `2.1.0-rc2` `2.1.0-rc3` `2.1.1` `2.1.10` `2.1.11` `2.1.12` `2.1.13` `2.1.14` `2.1.15` `2.1.16` `2.1.17` `2.1.2` `2.1.3` `2.1.4` `2.1.5` `2.1.6` `2.1.7` `2.1.8` `2.1.9`
`2.2` to before 2.2.9	`2.2.9`Advisories →
Also listed as affected (9) `2.2.0` `2.2.1` `2.2.2` `2.2.3` `2.2.4` `2.2.5` `2.2.6` `2.2.7` `2.2.8`
`2.3` to before 2.3.2	`2.3.2`Advisories →
Also listed as affected (2) `2.3.0` `2.3.1`

Description

An insecure direct object reference (IDOR) vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can be exploited by an administrator with limited privileges to delete the downloadable products folder.

GHSA-7g5j-q8qj-8984

Affected versions

magento/community-edition Packagist

Description

References