CWE Code: 264
Vulnerability Type: privilege_escalation
CVSS Score: 5.5
CWE Name:  Permissions Privileges and Access Controls
Summary: an insecure direct object reference (idor) vulnerability exists in magento 2.1 prior to 2.1.18, magento 2.2 prior to 2.2.9, magento 2.3 prior to 2.3.2. this can be exploited by an administrator with limited privileges to delete the downloadable products folder.
Access Authentication: SINGLE
Access Complexity: LOW
Access Vector: NETWORK
Impact (C/I/A): NONE/PARTIAL/PARTIAL
Published Date: 2019-08-02
Last Modified Date: 2019-08-07