deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-9f58-4465-23c7
Package: code16/sharp (COMPOSER)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Vulnerable versions: < 9.11.1
Patched in: 9.11.1

Summary: Sharp user-provided input can be evaluated in a SharpShowTextField with Vue template syntax

Details:
A Cross-Site Scripting (XSS) vulnerability was discovered in code16/sharp when rendering content using the SharpShowTextField component.

In affected versions, expressions wrapped in `{{` & `}}` were evaluated by Vue. This allowed attackers to inject arbitrary JavaScript or HTML that executes in the browser when the field is displayed.

For example, if a field’s value contains `{{ Math.random() }}`, it will be executed instead of being displayed as text.

### Impact

Attackers who can control content rendered through SharpShowTextField could execute arbitrary JavaScript in the context of an authenticated user’s browser.

This could lead to:

- Theft of user session tokens.
- Unauthorized actions performed on behalf of users.
- Injection of malicious content into the admin panel.

### Patches

The issue has been fixed in v9.11.1 of code16/sharp package.

### Mitigation / Workarounds

Sanitize or encode any user-provided data that may include (`{{` & `}}`) before displaying it in a SharpShowTextField.
GitHub Security Advisory: GHSA-rjcm-7v2p-9265
Package: moodle/moodle (COMPOSER)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-284: Improper Access Control
Vulnerable versions: >= 5.0.0-beta, < 5.0.3
Patched in: 5.0.3

Summary: Moodle course access permissions are not properly checked in course_output_fragment_course_overview

Details:
A flaw was found in the course overview output function where user access permissions were not fully enforced. This could allow unauthorized users to view information about courses they should not have access to, potentially exposing limited course details.
GitHub Security Advisory: GHSA-8fcv-4qp9-pg32
Package: moodle/moodle (COMPOSER)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: >= 4.5.0-beta, < 4.5.7
Patched in: 4.5.7

Summary: Moodle sends quiz-related messages to inactive/suspended users

Details:
Moodle failed to verify enrolment status correctly when sending quiz notifications. As a result, suspended or inactive users might receive quiz-related messages, leaking limited course information.
GitHub Security Advisory: GHSA-8fcv-4qp9-pg32
Package: moodle/moodle (COMPOSER)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: >= 5.0.0-beta, < 5.0.3
Patched in: 5.0.3

Summary: Moodle sends quiz-related messages to inactive/suspended users

Details:
Moodle failed to verify enrolment status correctly when sending quiz notifications. As a result, suspended or inactive users might receive quiz-related messages, leaking limited course information.
GitHub Security Advisory: GHSA-422v-w6c5-vq42
Package: moodle/moodle (COMPOSER)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerable versions: < 4.1.21
Patched in: 4.1.21

Summary: Moodle exposed the names of hidden groups to users

Details:
Moodle exposed the names of hidden groups to users who had permission to create calendar events but not to view hidden groups. This could reveal private or restricted group information.
GitHub Security Advisory: GHSA-422v-w6c5-vq42
Package: moodle/moodle (COMPOSER)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerable versions: >= 4.2.0-beta, < 4.4.11
Patched in: 4.4.11

Summary: Moodle exposed the names of hidden groups to users

Details:
Moodle exposed the names of hidden groups to users who had permission to create calendar events but not to view hidden groups. This could reveal private or restricted group information.
GitHub Security Advisory: GHSA-422v-w6c5-vq42
Package: moodle/moodle (COMPOSER)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerable versions: >= 4.5.0-beta, < 4.5.7
Patched in: 4.5.7

Summary: Moodle exposed the names of hidden groups to users

Details:
Moodle exposed the names of hidden groups to users who had permission to create calendar events but not to view hidden groups. This could reveal private or restricted group information.
GitHub Security Advisory: GHSA-422v-w6c5-vq42
Package: moodle/moodle (COMPOSER)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
Vulnerable versions: >= 5.0.0-beta, < 5.0.3
Patched in: 5.0.3

Summary: Moodle exposed the names of hidden groups to users

Details:
Moodle exposed the names of hidden groups to users who had permission to create calendar events but not to view hidden groups. This could reveal private or restricted group information.
GitHub Security Advisory: GHSA-w29j-8phw-ffjf
Package: moodle/moodle (COMPOSER)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-285: Improper Authorization
Vulnerable versions: < 4.1.21
Patched in: 4.1.21

Summary: Moodle has a time restriction bypass

Details:
An issue in Moodle's timed assignment feature allowed students to bypass the time restriction, potentially giving them more time than allowed to complete an assessment.
GitHub Security Advisory: GHSA-w29j-8phw-ffjf
Package: moodle/moodle (COMPOSER)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-285: Improper Authorization
Vulnerable versions: >= 4.2.0-beta, < 4.4.11
Patched in: 4.4.11

Summary: Moodle has a time restriction bypass

Details:
An issue in Moodle's timed assignment feature allowed students to bypass the time restriction, potentially giving them more time than allowed to complete an assessment.
GitHub Security Advisory: GHSA-w29j-8phw-ffjf
Package: moodle/moodle (COMPOSER)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-285: Improper Authorization
Vulnerable versions: >= 4.5.0-beta, < 4.5.7
Patched in: 4.5.7

Summary: Moodle has a time restriction bypass

Details:
An issue in Moodle's timed assignment feature allowed students to bypass the time restriction, potentially giving them more time than allowed to complete an assessment.
GitHub Security Advisory: GHSA-w29j-8phw-ffjf
Package: moodle/moodle (COMPOSER)
Severity: MODERATE (CVSS 5.4)
CWE: CWE-285: Improper Authorization
Vulnerable versions: >= 5.0.0-beta, < 5.0.3
Patched in: 5.0.3

Summary: Moodle has a time restriction bypass

Details:
An issue in Moodle's timed assignment feature allowed students to bypass the time restriction, potentially giving them more time than allowed to complete an assessment.
GitHub Security Advisory: GHSA-c5cj-xp43-qcc3
Package: moodle/moodle (COMPOSER)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-548: Exposure of Information Through Directory Listing
Vulnerable versions: >= 4.5.0-beta, < 4.5.7
Patched in: 4.5.7

Summary: Moodle's error handling leads to sensitive information disclosure

Details:
An error-handling issue in the Moodle router (r.php) could cause the application to display internal directory listings when specific HTTP headers were not properly configured.
GitHub Security Advisory: GHSA-c5cj-xp43-qcc3
Package: moodle/moodle (COMPOSER)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-548: Exposure of Information Through Directory Listing
Vulnerable versions: >= 5.0.0-beta, < 5.0.3
Patched in: 5.0.3

Summary: Moodle's error handling leads to sensitive information disclosure

Details:
An error-handling issue in the Moodle router (r.php) could cause the application to display internal directory listings when specific HTTP headers were not properly configured.
GitHub Security Advisory: GHSA-m58f-9pvv-8mp2
Package: moodle/moodle (COMPOSER)
Severity: HIGH (CVSS 7.5)
CWE: CWE-307: Improper Restriction of Excessive Authentication Attempts
Vulnerable versions: < 4.1.21
Patched in: 4.1.21

Summary: Moodle vulnerable to brute-force password guesses

Details:
Moodle's mobile and web service authentication endpoints did not sufficiently restrict repeated password attempts, making them susceptible to brute-force attacks.
GitHub Security Advisory: GHSA-m58f-9pvv-8mp2
Package: moodle/moodle (COMPOSER)
Severity: HIGH (CVSS 7.5)
CWE: CWE-307: Improper Restriction of Excessive Authentication Attempts
Vulnerable versions: >= 4.2.0-beta, < 4.4.11
Patched in: 4.4.11

Summary: Moodle vulnerable to brute-force password guesses

Details:
Moodle's mobile and web service authentication endpoints did not sufficiently restrict repeated password attempts, making them susceptible to brute-force attacks.
GitHub Security Advisory: GHSA-m58f-9pvv-8mp2
Package: moodle/moodle (COMPOSER)
Severity: HIGH (CVSS 7.5)
CWE: CWE-307: Improper Restriction of Excessive Authentication Attempts
Vulnerable versions: >= 4.5.0-beta, < 4.5.7
Patched in: 4.5.7

Summary: Moodle vulnerable to brute-force password guesses

Details:
Moodle's mobile and web service authentication endpoints did not sufficiently restrict repeated password attempts, making them susceptible to brute-force attacks.
GitHub Security Advisory: GHSA-m58f-9pvv-8mp2
Package: moodle/moodle (COMPOSER)
Severity: HIGH (CVSS 7.5)
CWE: CWE-307: Improper Restriction of Excessive Authentication Attempts
Vulnerable versions: >= 5.0.0-beta, < 5.0.3
Patched in: 5.0.3

Summary: Moodle vulnerable to brute-force password guesses

Details:
Moodle's mobile and web service authentication endpoints did not sufficiently restrict repeated password attempts, making them susceptible to brute-force attacks.
GitHub Security Advisory: GHSA-g9pc-8g42-g6vq
Package: spiral/roadrunner (COMPOSER)
Severity: CRITICAL (CVSS 9.1)
CWE: CWE-444: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling'), CWE-1395: Dependency on Vulnerable Third-Party Component
Vulnerable versions: < 2025.1.0
Patched in: 2025.1.0

Summary: RoadRunner is at risk of HTTP Request/Response Smuggling through vulnerable dependency

Details:
The net/http package dependency used by RoadRunner improperly accepts a bare LF as a line terminator in chunked data chunk-size lines. This can permit request smuggling if a net/http server is used in conjunction with a server that incorrectly accepts a bare LF as part of a chunk-ext.
GitHub Security Advisory: GHSA-25wf-7x6c-wmpf
Package: moodle/moodle (COMPOSER)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-287: Improper Authentication
Vulnerable versions: >= 4.4.0-beta, < 4.4.11
Patched in: 4.4.11

Summary: Moodle does not properly enforce MFA

Details:
A serious authentication flaw allowed attackers with valid credentials to bypass multi-factor authentication under certain conditions, potentially compromising user accounts.
GitHub Security Advisory: GHSA-25wf-7x6c-wmpf
Package: moodle/moodle (COMPOSER)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-287: Improper Authentication
Vulnerable versions: >= 4.5.0-beta, < 4.5.7
Patched in: 4.5.7

Summary: Moodle does not properly enforce MFA

Details:
A serious authentication flaw allowed attackers with valid credentials to bypass multi-factor authentication under certain conditions, potentially compromising user accounts.
GitHub Security Advisory: GHSA-25wf-7x6c-wmpf
Package: moodle/moodle (COMPOSER)
Severity: MODERATE (CVSS 5.3)
CWE: CWE-287: Improper Authentication
Vulnerable versions: >= 5.0.0-beta, < 5.0.3
Patched in: 5.0.3

Summary: Moodle does not properly enforce MFA

Details:
A serious authentication flaw allowed attackers with valid credentials to bypass multi-factor authentication under certain conditions, potentially compromising user accounts.
GitHub Security Advisory: GHSA-74w7-cr4v-wf2v
Package: magento/community-edition (COMPOSER)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-285: Improper Authorization
Vulnerable versions: = 2.4.7
Patched in: unpatched

Summary: Magento Improper Access Control Leads to Privilege escalation

Details:
Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and modify minor information. Exploitation of this issue does not require user interaction.
GitHub Security Advisory: GHSA-74w7-cr4v-wf2v
Package: magento/community-edition (COMPOSER)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-285: Improper Authorization
Vulnerable versions: = 2.4.6
Patched in: unpatched

Summary: Magento Improper Access Control Leads to Privilege escalation

Details:
Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and modify minor information. Exploitation of this issue does not require user interaction.
GitHub Security Advisory: GHSA-74w7-cr4v-wf2v
Package: magento/community-edition (COMPOSER)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-285: Improper Authorization
Vulnerable versions: = 2.4.5
Patched in: unpatched

Summary: Magento Improper Access Control Leads to Privilege escalation

Details:
Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and modify minor information. Exploitation of this issue does not require user interaction.
GitHub Security Advisory: GHSA-74w7-cr4v-wf2v
Package: magento/community-edition (COMPOSER)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-285: Improper Authorization
Vulnerable versions: = 2.4.4
Patched in: unpatched

Summary: Magento Improper Access Control Leads to Privilege escalation

Details:
Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and modify minor information. Exploitation of this issue does not require user interaction.
GitHub Security Advisory: GHSA-74w7-cr4v-wf2v
Package: magento/community-edition (COMPOSER)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-285: Improper Authorization
Vulnerable versions: < 2.4.4-p10
Patched in: 2.4.4-p10

Summary: Magento Improper Access Control Leads to Privilege escalation

Details:
Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and modify minor information. Exploitation of this issue does not require user interaction.
GitHub Security Advisory: GHSA-74w7-cr4v-wf2v
Package: magento/community-edition (COMPOSER)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-285: Improper Authorization
Vulnerable versions: >= 2.4.5-p1, < 2.4.5-p9
Patched in: 2.4.5-p9

Summary: Magento Improper Access Control Leads to Privilege escalation

Details:
Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and modify minor information. Exploitation of this issue does not require user interaction.
GitHub Security Advisory: GHSA-74w7-cr4v-wf2v
Package: magento/community-edition (COMPOSER)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-285: Improper Authorization
Vulnerable versions: >= 2.4.6-p1, < 2.4.6-p7
Patched in: 2.4.6-p7

Summary: Magento Improper Access Control Leads to Privilege escalation

Details:
Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and modify minor information. Exploitation of this issue does not require user interaction.
GitHub Security Advisory: GHSA-74w7-cr4v-wf2v
Package: magento/community-edition (COMPOSER)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-285: Improper Authorization
Vulnerable versions: >= 2.4.7-beta1, < 2.4.7-p2
Patched in: 2.4.7-p2

Summary: Magento Improper Access Control Leads to Privilege escalation

Details:
Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and modify minor information. Exploitation of this issue does not require user interaction.
GitHub Security Advisory: GHSA-74w7-cr4v-wf2v
Package: magento/project-community-edition (COMPOSER)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-285: Improper Authorization
Vulnerable versions: <= 2.0.2
Patched in: unpatched

Summary: Magento Improper Access Control Leads to Privilege escalation

Details:
Adobe Commerce versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and modify minor information. Exploitation of this issue does not require user interaction.
GitHub Security Advisory: GHSA-4xmj-f664-hv98
Package: magento/community-edition (COMPOSER)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-285: Improper Authorization
Vulnerable versions: = 2.4.7
Patched in: unpatched

Summary: Magento Improper Authorization leads to Security feature bypass

Details:
Magento versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and disclose minor information. Exploitation of this issue does not require user interaction.
GitHub Security Advisory: GHSA-4xmj-f664-hv98
Package: magento/community-edition (COMPOSER)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-285: Improper Authorization
Vulnerable versions: = 2.4.6
Patched in: unpatched

Summary: Magento Improper Authorization leads to Security feature bypass

Details:
Magento versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and disclose minor information. Exploitation of this issue does not require user interaction.
GitHub Security Advisory: GHSA-4xmj-f664-hv98
Package: magento/community-edition (COMPOSER)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-285: Improper Authorization
Vulnerable versions: = 2.4.5
Patched in: unpatched

Summary: Magento Improper Authorization leads to Security feature bypass

Details:
Magento versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and disclose minor information. Exploitation of this issue does not require user interaction.
GitHub Security Advisory: GHSA-4xmj-f664-hv98
Package: magento/community-edition (COMPOSER)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-285: Improper Authorization
Vulnerable versions: = 2.4.4
Patched in: unpatched

Summary: Magento Improper Authorization leads to Security feature bypass

Details:
Magento versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and disclose minor information. Exploitation of this issue does not require user interaction.
GitHub Security Advisory: GHSA-4xmj-f664-hv98
Package: magento/community-edition (COMPOSER)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-285: Improper Authorization
Vulnerable versions: < 2.4.4-p10
Patched in: 2.4.4-p10

Summary: Magento Improper Authorization leads to Security feature bypass

Details:
Magento versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and disclose minor information. Exploitation of this issue does not require user interaction.
GitHub Security Advisory: GHSA-4xmj-f664-hv98
Package: magento/community-edition (COMPOSER)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-285: Improper Authorization
Vulnerable versions: >= 2.4.5-p1, < 2.4.5-p9
Patched in: 2.4.5-p9

Summary: Magento Improper Authorization leads to Security feature bypass

Details:
Magento versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and disclose minor information. Exploitation of this issue does not require user interaction.
GitHub Security Advisory: GHSA-4xmj-f664-hv98
Package: magento/community-edition (COMPOSER)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-285: Improper Authorization
Vulnerable versions: >= 2.4.6-p1, < 2.4.6-p7
Patched in: 2.4.6-p7

Summary: Magento Improper Authorization leads to Security feature bypass

Details:
Magento versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and disclose minor information. Exploitation of this issue does not require user interaction.
GitHub Security Advisory: GHSA-4xmj-f664-hv98
Package: magento/community-edition (COMPOSER)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-285: Improper Authorization
Vulnerable versions: >= 2.4.7-beta1, < 2.4.7-p2
Patched in: 2.4.7-p2

Summary: Magento Improper Authorization leads to Security feature bypass

Details:
Magento versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and disclose minor information. Exploitation of this issue does not require user interaction.
GitHub Security Advisory: GHSA-4xmj-f664-hv98
Package: magento/project-community-edition (COMPOSER)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-285: Improper Authorization
Vulnerable versions: <= 2.0.2
Patched in: unpatched

Summary: Magento Improper Authorization leads to Security feature bypass

Details:
Magento versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and disclose minor information. Exploitation of this issue does not require user interaction.
GitHub Security Advisory: GHSA-4xgg-rw35-7mv5
Package: magento/community-edition (COMPOSER)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-285: Improper Authorization
Vulnerable versions: = 2.4.7
Patched in: unpatched

Summary: Magento Improper Authorization leads to Security feature bypass

Details:
Magento versions 2.4.7-p1, 2.4.6-p6, 2.4.5-p8, 2.4.4-p9 and earlier are affected by an Improper Authorization vulnerability that could result in a Security feature bypass. A low-privileged attacker could leverage this vulnerability to bypass security measures and disclose minor information. Exploitation of this issue does not require user interaction.