-
CVSS Score
-Basic Information
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| magento/community-edition | composer | < 2.3.6 | 2.3.6 |
| magento/community-edition | composer | >= 2.4.0, < 2.4.1-p1 | 2.4.1-p1 |
| magento/project-community-edition | composer | <= 2.0.2 |
Miggo AIRoot Cause AnalysisThe vulnerability centers around improper access control in the Login as Customer module. In Magento architecture, controller actions handling sensitive operations like customer session impersonation should enforce admin privileges via _isAllowed() checks or ACL annotations. The absence of these checks in the Login controller's execute method would allow unauthorized access. This pattern matches Magento's typical authorization structure and aligns with the CWE-284 classification. The specific focus on the Login as Customer module in advisory descriptions strongly suggests the vulnerability resides in its core authorization workflow.