CVE-2019-7925 : An insecure direct object reference (IDOR) vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2

An insecure direct object reference (IDOR) vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can be exploited by an administrator with limited privileges to delete the downloadable products folder.

Published 2019-08-02 22:15:18

Updated 2020-08-24 17:37:01

Source Adobe Systems Incorporated

View at NVD, CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2019-7925

EPSS FAQ

0.09%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 37 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2019-7925

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
5.5	MEDIUM	AV:N/AC:L/Au:S/C:N/I:P/A:P	8.0	4.9	NIST
Access Vector: Network Access Complexity: Low Authentication: Single Confidentiality Impact: None Integrity Impact: Partial Availability Impact: Partial
4.9	MEDIUM	CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:H/A:N	1.2	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: High User Interaction: None Scope: Unchanged Confidentiality: None Integrity: High Availability: None

CWE ids for CVE-2019-7925

CWE-639 Authorization Bypass Through User-Controlled Key

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

Assigned by: nvd@nist.gov (Primary)

Products affected by CVE-2019-7925

Magento » Magento » Open Source Edition
Versions from including (>=) 2.3.0 and before (<) 2.3.2
cpe:2.3:a:magento:magento:*:*:*:*:open_source:*:*:*
Matching versions
Magento » Magento » Open Source Edition
Versions from including (>=) 2.2.0 and before (<) 2.2.9
cpe:2.3:a:magento:magento:*:*:*:*:open_source:*:*:*
Matching versions
Magento » Magento » Open Source Edition
Versions from including (>=) 2.1.0 and before (<) 2.1.18
cpe:2.3:a:magento:magento:*:*:*:*:open_source:*:*:*
Matching versions

Vulnerability Details : CVE-2019-7925

Exploit prediction scoring system (EPSS) score for CVE-2019-7925

CVSS scores for CVE-2019-7925

CWE ids for CVE-2019-7925

References for CVE-2019-7925

Products affected by CVE-2019-7925