Description
Insecure authentication and session management vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An unauthenticated user can leverage a guest session id value following a successful login to gain access to customer account index page.
Remediation
References
Related Vulnerabilities
MySQL CVE-2016-8327 Vulnerability (CVE-2016-8327)
Jboss EAP Session Fixation Vulnerability (CVE-2021-20324)
WordPress Plugin Search & Replace SQL Injection (3.2.1)
WordPress Plugin Product Input Fields for WooCommerce Arbitrary File Download (1.2.6)
WordPress Plugin WP Import Export Lite Information Disclosure (3.9.15)