Magento Insufficient authorization check when adding users to company accounts
Moderate severity
GitHub Reviewed
Published
May 24, 2022
to the GitHub Advisory Database
•
Updated May 15, 2024
Package
Affected versions
>= 2.1, < 2.1.18
>= 2.2, < 2.2.9
>= 2.3, < 2.3.2
Patched versions
2.1.18
2.2.9
2.3.2
Description
Published by the National Vulnerability Database
Aug 2, 2019
Published to the GitHub Advisory Database
May 24, 2022
Last updated
May 15, 2024
Reviewed
May 15, 2024
An insecure direct object reference (IDOR) vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 due to insufficient authorizations checks. This can be abused by a user with admin privileges to add users to company accounts or modify existing user details.
References