GHSA-7g5j-q8qj-8984
GitHub Security Advisory
Magento Insecure Direct Object Reference (IDOR) vulnerability
✓ GitHub Reviewed
MODERATE
Has CVE
Advisory Details
An insecure direct object reference (IDOR) vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can be exploited by an administrator with limited privileges to delete the downloadable products folder.
Affected Packages
Packagist
magento/community-edition
Affected versions:
2.1
(fixed in 2.1.18)
Packagist
magento/community-edition
Affected versions:
2.2
(fixed in 2.2.9)
Packagist
magento/community-edition
Affected versions:
2.3
(fixed in 2.3.2)
Related CVEs
Key Information
5.0
/10
Dataset
Last updated: June 14, 2025 6:24 AM
Data from GitHub Advisory Database. This information is provided for research and educational purposes.