-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| magento/community-edition | composer | >= 2.1.0, < 2.1.18 | 2.1.18 |
| magento/community-edition | composer | >= 2.2.0, < 2.2.9 | 2.2.9 |
| magento/community-edition | composer | >= 2.3.0, < 2.3.2 | 2.3.2 |
Miggo AIRoot Cause AnalysisThe vulnerability description explicitly mentions IDOR in RSS feeds leading to order detail exposure. Magento's RSS order feed functionality is typically handled by the Order/Index controller. The execute() method would process the request parameters (including order ID) and fetch order data. Without proper authorization checks validating user ownership of the requested order ID, this creates an IDOR vulnerability. The CWE-639 classification confirms this is an authorization bypass through user-controlled keys (order IDs in this case). While exact patch details aren't available, historical Magento security practices show these vulnerabilities are often fixed by adding customer session validation in controller actions handling sensitive data retrieval.
PHPPHPKEV Misses 88% of Exploited CVEs- Get the report