CVE-2019-7950: High severity centos libgcc vulnerability
An access control bypass vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An unauthenticated user can bypass access controls via REST API calls to assign themselves to an arbitrary company, thereby gaining read access to potentially confidental information.
Other sources
PRODSECBUG-2429: Insecure object reference via customer REST API
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2019-7950?
CVE-2019-7950 is classified as a critical vulnerability due to its potential to allow unauthorized access to sensitive information.
How do I fix CVE-2019-7950?
To fix CVE-2019-7950, upgrade to Magento version 2.1.18, 2.2.9, or 2.3.2 or later.
What types of software are affected by CVE-2019-7950?
CVE-2019-7950 affects Magento versions prior to 2.1.18, 2.2.9, and 2.3.2.
What can an attacker do with CVE-2019-7950?
An attacker can bypass access controls and assign themselves to an arbitrary company, gaining unauthorized read access.
Is there a patch available for CVE-2019-7950?
Yes, a security update patch is available for CVE-2019-7950 in the form of upgraded versions of Magento.