CVE-2019-8235

An insecure direct object reference (IDOR) vulnerability exists in Magento 2.3 prior to 2.3.1, 2.2 prior to 2.2.8, and 2.1 prior to 2.1.17 versions

published October 29, 2019

CVSS
—
EPSS
2%
Percentile
79.3
In the wild
Unconfirmed
What it is

An insecure direct object reference (IDOR) vulnerability exists in Magento 2.3 prior to 2.3.1, 2.2 prior to 2.2.8, and 2.1 prior to 2.1.17 versions. An authenticated user may be able to view personally identifiable shipping details of another user due to insufficient validation of user controlled input.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.01881 · 79.3th percentile
Published
2019-10-29T23:05Z
EPSS history
Timeline
  • 29 OCT 23:05Z
    An insecure direct object reference (IDOR) vulnerability exists in Magento 2.3 prior to 2.3.1, 2.2 prior to 2.2.8, and 2.1 prior to 2.1.17 versions
    cvelistv5