Miggo Logo
Miggo Vulnerability Database
→
CVE-2019-7950

CVE-2019-7950: Magento 2 Community Edition Access Control Bypass

7.5

CVSS Score
3.0

Basic Information

CVE ID
CVE-2019-7950
GHSA ID
GHSA-2fhr-f6q6-c4p2
EPSS Score
0.64368%
CWE
CWE-639
Published
5/24/2022
Updated
2/2/2024
KEV Status
No
Technology
TechnologyPHP

Technical Details

CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
magento/community-editioncomposer>= 2.1.0, < 2.1.182.1.18
magento/community-editioncomposer>= 2.2.0, < 2.2.92.2.9
magento/community-editioncomposer>= 2.3.0, < 2.3.22.3.2

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability involves unauthenticated REST API calls manipulating company assignments. The primary entry point would be the REST controller handling customer/company assignment requests (Assign::execute), which lacked authentication enforcement. The business logic method (CompanyAssignment::assignCustomerToCompany) would then process the user-controlled company ID without proper authorization checks, enabling the bypass. This matches CWE-639's pattern of authorization bypass through user-controlled keys (company IDs in this case).

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

*n ****ss *ontrol *yp*ss vuln*r**ility *xists in M***nto *.* prior to *.*.**, M***nto *.* prior to *.*.*, M***nto *.* prior to *.*.*. *n un*ut**nti**t** us*r **n *yp*ss ****ss *ontrols vi* R*ST *PI **lls to *ssi*n t**ms*lv*s to *n *r*itr*ry *omp*ny,

Reasoning

T** vuln*r**ility involv*s un*ut**nti**t** R*ST *PI **lls m*nipul*tin* *omp*ny *ssi*nm*nts. T** prim*ry *ntry point woul* ** t** R*ST *ontroll*r **n*lin* *ustom*r/*omp*ny *ssi*nm*nt r*qu*sts (`*ssi*n::*x**ut*`), w*i** l**k** *ut**nti**tion *n*or**m*n