CVE-2019-7872 — Authorization Bypass Through User-Controlled Key in Magento

CWE-639 — Authorization Bypass Through User-Controlled KeyCWE-285 — Improper Authorization4 documents4 sources
Severity
6.5MEDIUMNVD
EPSS
0.1%
top 74.14%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
MagentoMagento Community-editionAdobe Systems Incorporated Magento 2
Timeline
PublishedAug 2
Latest updateMay 24

Description

An insecure direct object reference (IDOR) vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 due to insufficient authorizations checks. This can be abused by a user with admin privileges to add users to company accounts or modify existing user details.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:NExploitability: 1.2 | Impact: 5.2

Affected Packages3 packages

▶NVDmagento/magento2.1.0 — 2.1.18+2
▶Packagistmagento/community-edition2.1 — 2.1.18+2
▶CVEListV5adobe_systems_incorporated/magento_2Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2

🔴Vulnerability Details

3
OSV
Magento Insufficient authorization check when adding users to company accounts↗2022-05-24
▶
GHSA
Magento Insufficient authorization check when adding users to company accounts↗2022-05-24
▶
CVEList
CVE-2019-7872: An insecure direct object reference (IDOR) vulnerability exists in Magento 2↗2019-08-02
▶
CVE-2019-7872 — Magento vulnerability | cvebase