Magento Insufficient authorization check when adding users to company accounts
An insecure direct object reference (IDOR) vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 due to insufficient authorizations checks. This can be abused by a user with admin privileges to add users to company accounts or modify existing user details.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2019-7872US | medium6.5 | — | ||
An insecure direct object reference (IDOR) vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 due to insufficient authoriza… | ||||
02
references
External citations — patches, advisories, analysis.
- https://github.com/FriendsOfPHP/security-advisories/blob/master/magento/product-community-edition/CVE-2019-7872.yamlWEB
- https://github.com/magento/magento2PACKAGE
- https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-13WEB
- https://nvd.nist.gov/vuln/detail/CVE-2019-7872ADVISORY
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan