Description

An Insecure Direct Object Reference (IDOR) vulnerability exists in the order processing workflow of Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can lead to unauthorized access to order details.

Remediation

References

CVE-2019-7890

Related Vulnerabilities

WordPress Plugin Media Tagz Gallery Multiple Unspecified Vulnerabilities (1.0)

Highcharts JS Incorrect Regular Expression Vulnerability (CVE-2018-20801)

WordPress Plugin Donation Forms by Charitable-Donations & Fundraising Platform for WordPress Privilege Escalation (1.7.0.12)

Rukovoditel Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2022-44948)

MySQL CVE-2014-0431 Vulnerability (CVE-2014-0431)

Severity

High

Classification

CVE-2019-7890 CWE-639 CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L

Tags

Missing Update Known Vulnerabilities