Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Serious security issue in Customer Address edit section #1107

Closed
kalpmehta opened this issue Mar 19, 2015 · 4 comments
Closed

Serious security issue in Customer Address edit section #1107

kalpmehta opened this issue Mar 19, 2015 · 4 comments
Labels
bug report

Comments

@kalpmehta
Copy link
Contributor

I have installed Magento2 latest beta version yesterday and was checking it today. I found a serious issue where customer can view/edit (yes EDIT!) another customer's address. It's very simple to reproduce, just change the ID of the address in the URL and you will be presented with that address to edit.

Proof of concept:

  • Register as a website user
  • Navigate to /customer/address/edit/id/[ANY-VALID-ADDRESS-ID]
  • View and/or Edit it

http://www.example.com/customer/address/edit/id/1/
I will be able to see that address (even if it's not mine) and will be allowed to edit it without any issue.

The version I am using: Magento ver. 0.42.0-beta11
@vpelipenko
Copy link
Contributor

@kalpmehta, thank you for posting this issue. We'll check it immediately and fix ASAP if it is confirmed.

@vpelipenko vpelipenko added Issue: Ready for Work Gate 4. Acknowledged. Issue is added to backlog and ready for development in progress labels Mar 19, 2015
@vpelipenko
Copy link
Contributor

Internal ticket: MAGETWO-35333. We are working on this issue now.

@kalpmehta
Copy link
Contributor Author

Thanks for acknowledging and quickly checking into this.

magento-team pushed a commit that referenced this issue Mar 23, 2015
@slavvka
MAGETWO-35333: [GITHUB] Serious security issue in Customer Address ed…
959f4be 
…it section #1107
magento-team pushed a commit that referenced this issue Mar 23, 2015
@slavvka
MAGETWO-35333: [GITHUB] Serious security issue in Customer Address ed…
6bef178 
…it section #1107
magento-team pushed a commit that referenced this issue Mar 23, 2015
@slavvka
MAGETWO-35333: [GITHUB] Serious security issue in Customer Address ed…
31cf945 
…it section #1107
vpelipenko added a commit that referenced this issue Mar 23, 2015
@vpelipenko
Merge pull request #172 from magento-south/BUGS
c04232b 
[South] MAGETWO-35333: [GITHUB] Serious security issue in Customer Address edit section #1107
@sshrewz
Copy link

sshrewz commented Mar 23, 2015

@kalpmehta, this has been resolved in 0.74.0-beta1. Thank you again for submitting this issue. We greatly appreciate your continued support in Magento!

@sshrewz sshrewz closed this as completed Mar 23, 2015
@sshrewz sshrewz removed Issue: Ready for Work Gate 4. Acknowledged. Issue is added to backlog and ready for development in progress labels Mar 23, 2015
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
bug report
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
3 participants
@vpelipenko @kalpmehta @sshrewz