Description
Names of disabled downloadable products could be disclosed due to inadequate validation of user input in Magento Open Source prior to 1.9.4.2, and Magento Commerce prior to 1.14.4.2, Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2.
Remediation
References
Related Vulnerabilities
MediaWiki Session Fixation Vulnerability (CVE-2013-4572)
WordPress Plugin Countdown Block Security Bypass (1.1.1)
WordPress Plugin xili-tidy-tags Cross-Site Request Forgery (1.12.03)
e107 Credentials Management Errors Vulnerability (CVE-2013-7305)
Ruby on Rails Permissions, Privileges, and Access Controls Vulnerability (CVE-2013-6417)