Description
A path traversal vulnerability in the WYSIWYG editor for Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2 could result in unauthorized access to uploaded images due to insufficient access control.
Remediation
References
Related Vulnerabilities
MediaWiki Improper Input Validation Vulnerability (CVE-2013-6453)
WebLogic CVE-2020-2801 Vulnerability (CVE-2020-2801)
GlassFish Exposure of Sensitive Information to an Unauthorized Actor Vulnerability (CVE-2017-3239)
WordPress Plugin Kraken.io Image Optimizer Cross-Site Request Forgery (2.6.5)
XWiki Incorrect Authorization Vulnerability (CVE-2022-23615)