deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-3rg7-wf37-54rm
Package: symfony/symfony (COMPOSER)
Severity: HIGH (CVSS 7.3)
CWE: CWE-647: Use of Non-Canonical URL Paths for Authorization Decisions
Vulnerable versions: >= 7.0.0, < 7.3.7
Patched in: 7.3.7

Summary: Symfony's incorrect parsing of PATH_INFO can lead to limited authorization bypass

Details:
### Description

The `Request` class improperly interprets some `PATH_INFO` in a way that leads to representing some URLs with a path that doesn't start with a `/`. This can allow bypassing some access control rules that are built with this `/`-prefix assumption.

### Resolution

The `Request` class now ensures that URL paths always start with a `/`.

The patch for this issue is available [here](https://github.com/symfony/symfony/commit/9962b91b12bb791322fa73836b350836b6db7cac) for branch 5.4.

### Credits

We would like to thank Andrew Atkinson for discovering the issue, Chris Smith for reporting it and Nicolas Grekas for providing the fix.
GitHub Security Advisory: GHSA-3rg7-wf37-54rm
Package: symfony/symfony (COMPOSER)
Severity: HIGH (CVSS 7.3)
CWE: CWE-647: Use of Non-Canonical URL Paths for Authorization Decisions
Vulnerable versions: >= 6.0.0, < 6.4.29
Patched in: 6.4.29

Summary: Symfony's incorrect parsing of PATH_INFO can lead to limited authorization bypass

Details:
### Description

The `Request` class improperly interprets some `PATH_INFO` in a way that leads to representing some URLs with a path that doesn't start with a `/`. This can allow bypassing some access control rules that are built with this `/`-prefix assumption.

### Resolution

The `Request` class now ensures that URL paths always start with a `/`.

The patch for this issue is available [here](https://github.com/symfony/symfony/commit/9962b91b12bb791322fa73836b350836b6db7cac) for branch 5.4.

### Credits

We would like to thank Andrew Atkinson for discovering the issue, Chris Smith for reporting it and Nicolas Grekas for providing the fix.
GitHub Security Advisory: GHSA-3rg7-wf37-54rm
Package: symfony/symfony (COMPOSER)
Severity: HIGH (CVSS 7.3)
CWE: CWE-647: Use of Non-Canonical URL Paths for Authorization Decisions
Vulnerable versions: >= 2.0.0, < 5.4.50
Patched in: 5.4.50

Summary: Symfony's incorrect parsing of PATH_INFO can lead to limited authorization bypass

Details:
### Description

The `Request` class improperly interprets some `PATH_INFO` in a way that leads to representing some URLs with a path that doesn't start with a `/`. This can allow bypassing some access control rules that are built with this `/`-prefix assumption.

### Resolution

The `Request` class now ensures that URL paths always start with a `/`.

The patch for this issue is available [here](https://github.com/symfony/symfony/commit/9962b91b12bb791322fa73836b350836b6db7cac) for branch 5.4.

### Credits

We would like to thank Andrew Atkinson for discovering the issue, Chris Smith for reporting it and Nicolas Grekas for providing the fix.
GitHub Security Advisory: GHSA-3rg7-wf37-54rm
Package: symfony/http-foundation (COMPOSER)
Severity: HIGH (CVSS 7.3)
CWE: CWE-647: Use of Non-Canonical URL Paths for Authorization Decisions
Vulnerable versions: >= 7.0.0, < 7.3.7
Patched in: 7.3.7

Summary: Symfony's incorrect parsing of PATH_INFO can lead to limited authorization bypass

Details:
### Description

The `Request` class improperly interprets some `PATH_INFO` in a way that leads to representing some URLs with a path that doesn't start with a `/`. This can allow bypassing some access control rules that are built with this `/`-prefix assumption.

### Resolution

The `Request` class now ensures that URL paths always start with a `/`.

The patch for this issue is available [here](https://github.com/symfony/symfony/commit/9962b91b12bb791322fa73836b350836b6db7cac) for branch 5.4.

### Credits

We would like to thank Andrew Atkinson for discovering the issue, Chris Smith for reporting it and Nicolas Grekas for providing the fix.
GitHub Security Advisory: GHSA-3rg7-wf37-54rm
Package: symfony/http-foundation (COMPOSER)
Severity: HIGH (CVSS 7.3)
CWE: CWE-647: Use of Non-Canonical URL Paths for Authorization Decisions
Vulnerable versions: >= 6.0.0, < 6.4.29
Patched in: 6.4.29

Summary: Symfony's incorrect parsing of PATH_INFO can lead to limited authorization bypass

Details:
### Description

The `Request` class improperly interprets some `PATH_INFO` in a way that leads to representing some URLs with a path that doesn't start with a `/`. This can allow bypassing some access control rules that are built with this `/`-prefix assumption.

### Resolution

The `Request` class now ensures that URL paths always start with a `/`.

The patch for this issue is available [here](https://github.com/symfony/symfony/commit/9962b91b12bb791322fa73836b350836b6db7cac) for branch 5.4.

### Credits

We would like to thank Andrew Atkinson for discovering the issue, Chris Smith for reporting it and Nicolas Grekas for providing the fix.
GitHub Security Advisory: GHSA-3rg7-wf37-54rm
Package: symfony/http-foundation (COMPOSER)
Severity: HIGH (CVSS 7.3)
CWE: CWE-647: Use of Non-Canonical URL Paths for Authorization Decisions
Vulnerable versions: < 5.4.50
Patched in: 5.4.50

Summary: Symfony's incorrect parsing of PATH_INFO can lead to limited authorization bypass

Details:
### Description

The `Request` class improperly interprets some `PATH_INFO` in a way that leads to representing some URLs with a path that doesn't start with a `/`. This can allow bypassing some access control rules that are built with this `/`-prefix assumption.

### Resolution

The `Request` class now ensures that URL paths always start with a `/`.

The patch for this issue is available [here](https://github.com/symfony/symfony/commit/9962b91b12bb791322fa73836b350836b6db7cac) for branch 5.4.

### Credits

We would like to thank Andrew Atkinson for discovering the issue, Chris Smith for reporting it and Nicolas Grekas for providing the fix.
GitHub Security Advisory: GHSA-6f58-j323-6472
Package: pimcore/admin-ui-classic-bundle (COMPOSER)
Severity: MODERATE (CVSS 4.3)
CWE: CWE-287: Improper Authentication, CWE-620: Unverified Password Change
Vulnerable versions: < 1.2.0-RC1
Patched in: 1.2.0-RC1

Summary: pimcore/admin-ui-classic-bundle Unverified Password Change

Details:
### Impact
As old password can be set as new password , it is considered as password policy violation.

Pimcore is not enforcing strict password policy which allow attacker to set old password as new password

Proof of Concept
1. Go to Admin link
2. login and click on -> "User | My Profile".
3. Go to change password now put old password as new password and click save.

### Patches
https://github.com/pimcore/admin-ui-classic-bundle/commit/498ac77e54541177be27b0c710e387c47b3836ea.patch

### Workarounds
Update to version 1.2.0 or apply this patches manually
https://github.com/pimcore/admin-ui-classic-bundle/commit/498ac77e54541177be27b0c710e387c47b3836ea.patch

### References
https://huntr.com/bounties/b031199d-192a-46e5-8c02-f7284ad74021/
GitHub Security Advisory: GHSA-wr57-3h2f-3q95
Package: magento/community-edition (COMPOSER)
Severity: HIGH (CVSS 7.5)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: < 2.3.7-p1
Patched in: 2.3.7-p1

Summary: Magento affected by a server-side denial-of-service using a GraphQL field

Details:
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability. An unauthenticated attacker could abuse this vulnerability to cause a server-side denial-of-service using a GraphQL field.
GitHub Security Advisory: GHSA-wr57-3h2f-3q95
Package: magento/community-edition (COMPOSER)
Severity: HIGH (CVSS 7.5)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: = 2.3.7
Patched in: unpatched

Summary: Magento affected by a server-side denial-of-service using a GraphQL field

Details:
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability. An unauthenticated attacker could abuse this vulnerability to cause a server-side denial-of-service using a GraphQL field.
GitHub Security Advisory: GHSA-wr57-3h2f-3q95
Package: magento/community-edition (COMPOSER)
Severity: HIGH (CVSS 7.5)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: >= 2.4.2-p1, < 2.4.2-p2
Patched in: 2.4.2-p2

Summary: Magento affected by a server-side denial-of-service using a GraphQL field

Details:
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability. An unauthenticated attacker could abuse this vulnerability to cause a server-side denial-of-service using a GraphQL field.
GitHub Security Advisory: GHSA-wr57-3h2f-3q95
Package: magento/community-edition (COMPOSER)
Severity: HIGH (CVSS 7.5)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: = 2.4.2
Patched in: unpatched

Summary: Magento affected by a server-side denial-of-service using a GraphQL field

Details:
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability. An unauthenticated attacker could abuse this vulnerability to cause a server-side denial-of-service using a GraphQL field.
GitHub Security Advisory: GHSA-wr57-3h2f-3q95
Package: magento/project-community-edition (COMPOSER)
Severity: HIGH (CVSS 7.5)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: <= 2.0.2
Patched in: unpatched

Summary: Magento affected by a server-side denial-of-service using a GraphQL field

Details:
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability. An unauthenticated attacker could abuse this vulnerability to cause a server-side denial-of-service using a GraphQL field.
GitHub Security Advisory: GHSA-6cwv-wj7v-73xp
Package: magento/community-edition (COMPOSER)
Severity: CRITICAL (CVSS 9.1)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: < 2.3.7-p1
Patched in: 2.3.7-p1

Summary: Magento executes code via the API File Option Upload Extension

Details:
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability in the API File Option Upload Extension. An attacker with Admin privileges can achieve unrestricted file upload which can result in remote code execution.
GitHub Security Advisory: GHSA-6cwv-wj7v-73xp
Package: magento/community-edition (COMPOSER)
Severity: CRITICAL (CVSS 9.1)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: = 2.3.7
Patched in: unpatched

Summary: Magento executes code via the API File Option Upload Extension

Details:
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability in the API File Option Upload Extension. An attacker with Admin privileges can achieve unrestricted file upload which can result in remote code execution.
GitHub Security Advisory: GHSA-6cwv-wj7v-73xp
Package: magento/community-edition (COMPOSER)
Severity: CRITICAL (CVSS 9.1)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: >= 2.4.2-p1, < 2.4.2-p2
Patched in: 2.4.2-p2

Summary: Magento executes code via the API File Option Upload Extension

Details:
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability in the API File Option Upload Extension. An attacker with Admin privileges can achieve unrestricted file upload which can result in remote code execution.
GitHub Security Advisory: GHSA-6cwv-wj7v-73xp
Package: magento/community-edition (COMPOSER)
Severity: CRITICAL (CVSS 9.1)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: = 2.4.2
Patched in: unpatched

Summary: Magento executes code via the API File Option Upload Extension

Details:
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability in the API File Option Upload Extension. An attacker with Admin privileges can achieve unrestricted file upload which can result in remote code execution.
GitHub Security Advisory: GHSA-6cwv-wj7v-73xp
Package: magento/project-community-edition (COMPOSER)
Severity: CRITICAL (CVSS 9.1)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: <= 2.0.2
Patched in: unpatched

Summary: Magento executes code via the API File Option Upload Extension

Details:
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability in the API File Option Upload Extension. An attacker with Admin privileges can achieve unrestricted file upload which can result in remote code execution.
GitHub Security Advisory: GHSA-36xq-7w8w-xp68
Package: magento/community-edition (COMPOSER)
Severity: HIGH (CVSS 8.0)
CWE: CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: = 2.4.2
Patched in: unpatched

Summary: Magento affected by a blind SSRF vulnerability in the bundled dotmailer extension

Details:
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a blind SSRF vulnerability in the bundled dotmailer extension. An attacker with admin privileges could abuse this to achieve remote code execution should Redis be enabled.
GitHub Security Advisory: GHSA-36xq-7w8w-xp68
Package: magento/community-edition (COMPOSER)
Severity: HIGH (CVSS 8.0)
CWE: CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: >= 2.4.2-p1, < 2.4.2-p2
Patched in: 2.4.2-p2

Summary: Magento affected by a blind SSRF vulnerability in the bundled dotmailer extension

Details:
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a blind SSRF vulnerability in the bundled dotmailer extension. An attacker with admin privileges could abuse this to achieve remote code execution should Redis be enabled.
GitHub Security Advisory: GHSA-36xq-7w8w-xp68
Package: magento/community-edition (COMPOSER)
Severity: HIGH (CVSS 8.0)
CWE: CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: = 2.3.7
Patched in: unpatched

Summary: Magento affected by a blind SSRF vulnerability in the bundled dotmailer extension

Details:
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a blind SSRF vulnerability in the bundled dotmailer extension. An attacker with admin privileges could abuse this to achieve remote code execution should Redis be enabled.
GitHub Security Advisory: GHSA-36xq-7w8w-xp68
Package: magento/community-edition (COMPOSER)
Severity: HIGH (CVSS 8.0)
CWE: CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: < 2.3.7-p1
Patched in: 2.3.7-p1

Summary: Magento affected by a blind SSRF vulnerability in the bundled dotmailer extension

Details:
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a blind SSRF vulnerability in the bundled dotmailer extension. An attacker with admin privileges could abuse this to achieve remote code execution should Redis be enabled.
GitHub Security Advisory: GHSA-36xq-7w8w-xp68
Package: magento/project-community-edition (COMPOSER)
Severity: HIGH (CVSS 8.0)
CWE: CWE-918: Server-Side Request Forgery (SSRF)
Vulnerable versions: <= 2.0.2
Patched in: unpatched

Summary: Magento affected by a blind SSRF vulnerability in the bundled dotmailer extension

Details:
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a blind SSRF vulnerability in the bundled dotmailer extension. An attacker with admin privileges could abuse this to achieve remote code execution should Redis be enabled.
GitHub Security Advisory: GHSA-mx5m-j5xr-jg8c
Package: magento/community-edition (COMPOSER)
Severity: HIGH (CVSS 7.2)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: = 2.4.2
Patched in: unpatched

Summary: Magento vulnerable to file upload attack

Details:
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability. An attacker with admin privileges could upload a specially crafted file in the 'pub/media` directory could lead to remote code execution.
GitHub Security Advisory: GHSA-mx5m-j5xr-jg8c
Package: magento/community-edition (COMPOSER)
Severity: HIGH (CVSS 7.2)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: >= 2.4.2-p1, < 2.4.2-p2
Patched in: 2.4.2-p2

Summary: Magento vulnerable to file upload attack

Details:
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability. An attacker with admin privileges could upload a specially crafted file in the 'pub/media` directory could lead to remote code execution.
GitHub Security Advisory: GHSA-mx5m-j5xr-jg8c
Package: magento/community-edition (COMPOSER)
Severity: HIGH (CVSS 7.2)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: = 2.3.7
Patched in: unpatched

Summary: Magento vulnerable to file upload attack

Details:
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability. An attacker with admin privileges could upload a specially crafted file in the 'pub/media` directory could lead to remote code execution.
GitHub Security Advisory: GHSA-mx5m-j5xr-jg8c
Package: magento/community-edition (COMPOSER)
Severity: HIGH (CVSS 7.2)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: < 2.3.7-p1
Patched in: 2.3.7-p1

Summary: Magento vulnerable to file upload attack

Details:
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability. An attacker with admin privileges could upload a specially crafted file in the 'pub/media` directory could lead to remote code execution.
GitHub Security Advisory: GHSA-mx5m-j5xr-jg8c
Package: magento/project-community-edition (COMPOSER)
Severity: HIGH (CVSS 7.2)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: <= 2.0.2
Patched in: unpatched

Summary: Magento vulnerable to file upload attack

Details:
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability. An attacker with admin privileges could upload a specially crafted file in the 'pub/media` directory could lead to remote code execution.
GitHub Security Advisory: GHSA-2pq5-gpqf-g4r3
Package: magento/community-edition (COMPOSER)
Severity: CRITICAL (CVSS 9.1)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: < 2.3.7-p1
Patched in: 2.3.7-p1

Summary: Magento has a  file extension restrictions bypass

Details:
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability. An attacker with admin privileges can upload a specially crafted file to bypass file extension restrictions and could lead to remote code execution.
GitHub Security Advisory: GHSA-2pq5-gpqf-g4r3
Package: magento/community-edition (COMPOSER)
Severity: CRITICAL (CVSS 9.1)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: = 2.3.7
Patched in: unpatched

Summary: Magento has a  file extension restrictions bypass

Details:
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability. An attacker with admin privileges can upload a specially crafted file to bypass file extension restrictions and could lead to remote code execution.
GitHub Security Advisory: GHSA-2pq5-gpqf-g4r3
Package: magento/community-edition (COMPOSER)
Severity: CRITICAL (CVSS 9.1)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: >= 2.4.2-p1, < 2.4.2-p2
Patched in: 2.4.2-p2

Summary: Magento has a  file extension restrictions bypass

Details:
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability. An attacker with admin privileges can upload a specially crafted file to bypass file extension restrictions and could lead to remote code execution.
GitHub Security Advisory: GHSA-2pq5-gpqf-g4r3
Package: magento/community-edition (COMPOSER)
Severity: CRITICAL (CVSS 9.1)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: = 2.4.2
Patched in: unpatched

Summary: Magento has a  file extension restrictions bypass

Details:
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability. An attacker with admin privileges can upload a specially crafted file to bypass file extension restrictions and could lead to remote code execution.
GitHub Security Advisory: GHSA-2pq5-gpqf-g4r3
Package: magento/project-community-edition (COMPOSER)
Severity: CRITICAL (CVSS 9.1)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: <= 2.0.2
Patched in: unpatched

Summary: Magento has a  file extension restrictions bypass

Details:
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability. An attacker with admin privileges can upload a specially crafted file to bypass file extension restrictions and could lead to remote code execution.
GitHub Security Advisory: GHSA-wgpr-9675-8r67
Package: magento/community-edition (COMPOSER)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: = 2.4.2
Patched in: unpatched

Summary: Magento discloses sensitive information via the Multishipping Module

Details:
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability in the Multishipping Module. An authenticated attacker could leverage this vulnerability to achieve sensitive information disclosure.
GitHub Security Advisory: GHSA-wgpr-9675-8r67
Package: magento/community-edition (COMPOSER)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: >= 2.4.2-p1, < 2.4.2-p2
Patched in: 2.4.2-p2

Summary: Magento discloses sensitive information via the Multishipping Module

Details:
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability in the Multishipping Module. An authenticated attacker could leverage this vulnerability to achieve sensitive information disclosure.
GitHub Security Advisory: GHSA-wgpr-9675-8r67
Package: magento/community-edition (COMPOSER)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: = 2.3.7
Patched in: unpatched

Summary: Magento discloses sensitive information via the Multishipping Module

Details:
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability in the Multishipping Module. An authenticated attacker could leverage this vulnerability to achieve sensitive information disclosure.
GitHub Security Advisory: GHSA-wgpr-9675-8r67
Package: magento/community-edition (COMPOSER)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: < 2.3.7-p1
Patched in: 2.3.7-p1

Summary: Magento discloses sensitive information via the Multishipping Module

Details:
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability in the Multishipping Module. An authenticated attacker could leverage this vulnerability to achieve sensitive information disclosure.