Insufficient enforcement of user access controls in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 could enable a low-privileged user to make unauthorized environment configuration changes.
Scores
Version
Score
Vecteur
Évalué par
CVSS 3.0
MEDIUM 6.5
CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N
NVD · nvd@nist.gov (Primary)
CVSS 2.0
MEDIUM 5.5
AV:N/AC:L/Au:S/C:N/I:P/A:P
NVD · nvd@nist.gov (Primary)
Avis
GHSA-5hcx-vg88-hgpm — Magento 2 Community Edition Insufficient Access Controls
