CVE-2019-8235

An insecure direct object reference (IDOR) vulnerability exists in Magento 2.3 prior to 2.3.1, 2.2 prior to 2.2.8, and 2.1 prior to 2.1.17 versions. An authenticated user may be able to view personally identifiable shipping details of another user due to insufficient validation of user controlled input.

Score

CVSS 3.1 6.5 Medium

Status

Modified - psirt@adobe.com

Published

2019-10-30

Last modified

2024-08-04

Weaknesses

CWE-639

Affected products

• Magento (Adobe)
• Magento (Magento)

References

• https://magento.com/security/patches/magento-2.3.1-2.2.8-and-2.1.17-security-update