Description
Insufficient enforcement of user access controls in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 could enable a low-privileged user to make unauthorized environment configuration changes.
Remediation
References
Related Vulnerabilities
WordPress Plugin WPGraphQL Denial of Service (1.3.5)
WordPress Plugin Stripe Payment for WooCommerce Security Bypass (3.7.7)
WordPress Plugin WooCommerce Blocks SQL Injection (5.5.0)
Moodle Permissions, Privileges, and Access Controls Vulnerability (CVE-2012-3391)
WordPress Server-Side Request Forgery (SSRF) Vulnerability (CVE-2017-9066)