-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| magento/community-edition | composer | < 2.3.6-p1 | 2.3.6-p1 |
| magento/community-edition | composer | >= 2.4.0, < 2.4.1-p1 | 2.4.1-p1 |
| magento/project-community-edition | composer | <= 2.0.2 |
PHPPHPMiggo AIRoot Cause AnalysisThe vulnerability is an IDOR in the product module tied to improper authorization (CWE-285/639). Admin product edit controllers are high-value targets for such flaws. Magento's Product\Edit controller would naturally handle product IDs from requests, and historical patching patterns show similar vulnerabilities were addressed by adding ACL checks in this context. While no direct code diffs are available, the combination of the vulnerability type, affected component (product module), and CWE mapping strongly implicates this entry point.
Ongoing coverage of React2Shell