-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| magento/community-edition | composer | >= 2.1, < 2.1.18 | 2.1.18 |
| magento/community-edition | composer | >= 2.2, < 2.2.9 | 2.2.9 |
| magento/community-edition | composer | >= 2.3, < 2.3.2 | 2.3.2 |
Miggo AIRoot Cause AnalysisThe vulnerability stems from missing product status validation when accessing downloadable product samples. In Magento's architecture:
Though exact patch code isn't shown, the CWE-20 classification and Magento's security bulletin both indicate these core input processing points would require modifications to add product status checks. The medium confidence reflects educated inference based on Magento's pattern of handling downloadable products and typical vulnerability patterns in controller actions.