PT-2019-18827 · Adobe · Magento

Published 2019-08-02 · Updated 2022-05-24 · CVE-2019-7925

Positive Technologies (AI Summary)

CVSS v2.0

5.5

Medium

Base vector

AV:N/AC:L/Au:S/C:N/I:P/A:P

Name of the Vulnerable Software and Affected Versions Magento 2.1 versions prior to 2.1.18 Magento 2.2 versions prior to 2.2.9 Magento 2.3 versions prior to 2.3.2

Description An insecure direct object reference (IDOR) issue exists, allowing an administrator with limited privileges to delete the downloadable products folder.

Recommendations For Magento 2.1 versions prior to 2.1.18, update to version 2.1.18 or later. For Magento 2.2 versions prior to 2.2.9, update to version 2.2.9 or later. For Magento 2.3 versions prior to 2.3.2, update to version 2.3.2 or later.

Exploit

Fix

IDOR

Path traversal

Weakness Enumeration

CWE-639

CWE-22

Related Identifiers

CVE-2019-7925

GHSA-7G5J-Q8QJ-8984

Affected Products

Magento

References · 7

• 🔥 https://github.com/FriendsOfPHP/security-advisories/blob/master/magento/product-community-edition/CVE-2019-7925.yaml · Exploit
• https://osv.dev/vulnerability/CVE-2019-7925 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-7925 · Security Note
• https://magento.com/security/patches/magento-2.3.2-2.2.9-and-2.1.18-security-update-23 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-7g5j-q8qj-8984 · Vendor Advisory
• https://github.com/magento/magento2 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-7925 · Note