Description

An insecure direct object reference (IDOR) vulnerability exists in Magento 2.3 prior to 2.3.1, 2.2 prior to 2.2.8, and 2.1 prior to 2.1.17 versions. An authenticated user may be able to view personally identifiable shipping details of another user due to insufficient validation of user controlled input.

Remediation

References

CVE-2019-8235

Related Vulnerabilities

IBM RTC Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2018-1983)

WordPress Plugin WP-Live Chat by 3CX Cross-Site Scripting (8.0.05)

WordPress Plugin Flash Photo Gallery Cross-Site Scripting (0.7)

Roundcube Improper Input Validation Vulnerability (CVE-2011-1491)

MySQL CVE-2021-2194 Vulnerability (CVE-2021-2194)

Severity

Medium

Classification

CVE-2019-8235 CWE-639 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Tags

Missing Update Known Vulnerabilities