Magento Insecure Direct Object Reference (IDOR) Vulnerability in magento/community-edition
Summary
CVE-2019-7925: Magento Insecure Direct Object Reference (IDOR) vulnerability. Affects magento/community-edition across 3 version ranges.
>= 2.1, < 2.1.18
>= 2.2, < 2.2.9
>= 2.3, < 2.3.2
Fixed in 2.1.18, 2.2.9 or 2.3.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Magento is an open-source e-commerce platform written in PHP. It provides a flexible shopping cart system and robust functionality for online merchants. The magento/community-edition package is a popular distribution of Magento that includes all the necessary components for setting up an e-commerce website. However, this package is vulnerable to an insecure direct object reference (IDOR) vulnerability.
Vulnerability Detail
The insecure direct object reference (IDOR) vulnerability in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, and Magento 2.3 prior to 2.3.2 allows an administrator with limited privileges to delete the downloadable products folder. This vulnerability can be exploited to gain unauthorized access and delete important files, potentially causing data loss and disruption to the e-commerce website.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 2.1, < 2.1.182.1.18composer require magento/community-edition:2.1.18 -
>= 2.2, < 2.2.92.2.9composer require magento/community-edition:2.2.9 -
>= 2.3, < 2.3.22.3.2composer require magento/community-edition:2.3.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fixes by upgrading to the latest version of Magento.
Conclusion
The Magento Insecure Direct Object Reference (IDOR) vulnerability in the magento/community-edition package can lead to unauthorized access and deletion of important files. It is crucial to upgrade to the latest version of Magento to mitigate this vulnerability. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for magento/community-edition →
FAQ
An insecure direct object reference (IDOR) vulnerability occurs when an application allows direct access to internal objects or resources without proper authorization. In the case of Magento, this vulnerability allows an administrator with limited privileges to delete the downloadable products folder.
Exploiting this vulnerability can lead to unauthorized access and deletion of important files, potentially causing data loss and disruption to the e-commerce website. It can also be used as a stepping stone for further attacks and unauthorized actions.
Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, and Magento 2.3 prior to 2.3.2 are affected by this IDOR vulnerability.
No, there are no known workarounds for this vulnerability. It is crucial to apply the recommended fixes by upgrading to the latest version of Magento.
You can use Vulert's playground (https://vulert.com/scanner) to check if your Magento installation is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just the composer.lock file.
Related vulnerabilities
Recent vulnerabilities recorded for magento/community-edition.
