Description
An insecure direct object reference (IDOR) vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can be exploited by an administrator with limited privileges to delete the downloadable products folder.
Remediation
References
Related Vulnerabilities
WordPress Plugin Google Analytics Dashboard SQL Injection (2.0.4)
WordPress Plugin WP Photo Album Plus Cross-Site Scripting (5.4.17)
Joomla Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2009-1280)
WordPress Plugin WP Smart Import: Import any XML File to WordPress Cross-Site Scripting (1.0.2)
WordPress Plugin Open Graph for Facebook, Google+ and Twitter Card Tags Cross-Site Scripting (2.2.4)