CVSS 3.0
6.5 mediumCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:NCVE-2019-7872
Medium (6.5) in magento magento. EPSS 0.9% chance of exploitation in the next 30 days.
An insecure direct object reference (IDOR) vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 due to insufficient authorizations checks. This can be abused by a user with admin privileges to add users to company accounts or modify existing user details.
Severity
- EPSS
- 0.9% chance of exploitation in the next 30 days; higher than 59% of CVEs (scores of 2026-10-31)
- CWE
- CWE-639
- Published
- Modified
- Record from
- the NVD, synced
Affected
- magento:magento