CVE-2019-8235
At a glance Severity Not available EPSS EPSS 1.88 % · percentile 79 (2026-10-27) State PUBLISHED Published 2019-10-29 Updated 2024-08-04 Assigner adobe NVD status Modified Description An insecure direct object reference (IDOR) vulnerability exists in Magento 2.3 prior to 2.3.1, 2.2 prior to 2.2.8, and 2.1 prior to 2.1.17 versions. An authenticated user may be able to view personally identifiable shipping details of another user due to insufficient validation of user controlled input.
Scores Version Score Vector Scored by CVSS 3.1 MEDIUM 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N NVD · nvd@nist.gov (Primary) CVSS 2.0 MEDIUM 4.0 AV:N/AC:L/Au:S/C:P/I:N/A:N NVD · nvd@nist.gov (Primary)
Weaknesses (CWE)
European references
Affected configurations (NVD CPE) cpe:2.3:a:magento:magento:*:*:*:*:commerce:*:*:* ≥ 2.1.0 < 2.1.17cpe:2.3:a:magento:magento:*:*:*:*:open_source:*:*:* ≥ 2.1.0 < 2.1.17cpe:2.3:a:magento:magento:*:*:*:*:commerce:*:*:* ≥ 2.2.0 < 2.2.8cpe:2.3:a:magento:magento:*:*:*:*:open_source:*:*:* ≥ 2.2.0 < 2.2.8cpe:2.3:a:magento:magento:*:*:*:*:commerce:*:*:* ≥ 2.3.0 < 2.3.1cpe:2.3:a:magento:magento:*:*:*:*:open_source:*:*:* ≥ 2.3.0 < 2.3.1Affected products Product Versions Adobe · Magento affected 2.3 prior to 2.3.1 ; affected 2.2 prior to 2.2.8 ; affected 2.1 prior to 2.1.17
References
Sources
