Description
Insecure authentication and session management vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An unauthenticated user can append arbitrary session id that will not be invalidated by subsequent authentication.
Remediation
References
Related Vulnerabilities
WordPress Plugin Newsletter-Send awesome emails from WordPress CSV Injection (6.5.3)
WordPress Plugin s2Member Framework 's2_invoice' Parameter Remote Security Bypass (111105)
WordPress Plugin WP Visitor Statistics (Real Time Traffic) SQL Injection (5.5)