-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability involves unauthorized access to company credit history via IDOR. Magento's B2B CompanyCredit module is the logical location for this functionality. Controller actions handling credit history views and service methods retrieving credit details would require proper authorization checks that were likely missing. The pattern matches CWE-639 where user-controlled keys (company IDs) are used without access validation. While exact code isn't available, Magento's architecture patterns and the vulnerability nature strongly suggest these components would be involved in the insecure workflow.
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| magento/community-edition | composer | >= 2.1.0, < 2.1.18 | 2.1.18 |
| magento/community-edition | composer | >= 2.2.0, < 2.2.9 | 2.2.9 |
| magento/community-edition | composer | >= 2.3.0, < 2.3.2 | 2.3.2 |
PHPPHPOngoing coverage of React2Shell