Description
Insecure authentication and session management vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An unauthenticated user can append arbitrary session id that will not be invalidated by subsequent authentication.
Remediation
References
Related Vulnerabilities
WordPress Plugin WP OAuth Server (OAuth Authentication) Security Bypass (3.1.4)
WordPress Improper Privilege Management Vulnerability (CVE-2020-28035)
Oracle JRE CVE-2020-14779 Vulnerability (CVE-2020-14779)
WordPress Plugin Custom Add User Cross-Site Scripting (2.0.2)
Play Framework Uncontrolled Recursion Vulnerability (CVE-2020-26883)