CVE-2019-7950: Magento 2 Community Edition Access Control Bypass
An access control bypass vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. An unauthenticated user can bypass access controls via REST API calls to assign themselves to an arbitrary company, thereby gaining read access to potentially confidental information.
Other sources
Magento 2 Community Edition Access Control Bypass
— Packagist
PRODSECBUG-2429: Insecure object reference via customer REST API
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/magento/community-editionto a version that resolves this vulnerability.Fixed in 2.3.2 - Upgrade
Upgrade
composer/magento/community-editionto a version that resolves this vulnerability.Fixed in 2.2.9 - Upgrade
Upgrade
composer/magento/community-editionto a version that resolves this vulnerability.Fixed in 2.1.18 - Upgrade
Upgrade
composer/magento/product-community-editionto a version that resolves this vulnerability.Fixed in 2.1.18 - Upgrade
Upgrade
composer/magento/product-community-editionto a version that resolves this vulnerability.Fixed in 2.2.9 - Upgrade
Upgrade
composer/magento/product-community-editionto a version that resolves this vulnerability.Fixed in 2.3.2
Event History
Frequently Asked Questions
What is the severity of CVE-2019-7950?
CVE-2019-7950 is classified as a critical vulnerability due to its potential to allow unauthorized access to sensitive information.
How do I fix CVE-2019-7950?
To fix CVE-2019-7950, upgrade to Magento version 2.1.18, 2.2.9, or 2.3.2 or later.
What types of software are affected by CVE-2019-7950?
CVE-2019-7950 affects Magento versions prior to 2.1.18, 2.2.9, and 2.3.2.
What can an attacker do with CVE-2019-7950?
An attacker can bypass access controls and assign themselves to an arbitrary company, gaining unauthorized read access.
Is there a patch available for CVE-2019-7950?
Yes, a security update patch is available for CVE-2019-7950 in the form of upgraded versions of Magento.