Insufficient verification of request parameters allowed any user to delete or edit product reviews. The edited reviews were returned to a pending state. This attack did not depend on setting allowing guest users to post reviews. As a result, a malicious user could access the store for spamming purposes or delete all reviews from store.
Part of patch SUPEE-7405 and MAGENTO 2.0.1 SECURITY UPDATE
This vulnerability affects the following application versions:
- Magento 0.74.0-beta15
- Magento 0.74.0-beta16
- Magento 1.0.0-beta
- Magento 1.0.0-beta2
- Magento 1.0.0-beta3
- Magento 1.0.0-beta4
- Magento 1.0.0-beta5
- Magento 1.0.0-beta6
- Magento 1.4.0.0
- Magento 1.4.0.1
- Magento 1.4.1.0
- Magento 1.4.1.1
- Magento 1.4.2.0
- Magento 1.5.0.1
- Magento 1.5.1.0
- Magento 1.6.0.0
- Magento 1.6.1.0
- Magento 1.6.2.0
- Magento 1.7.0.0
- Magento 1.7.0.1
- Magento 1.7.0.2
- Magento 1.8.0.0
- Magento 1.8.1.0
- Magento 1.9.0.0
- Magento 1.9.0.1
- Magento 1.9.1.0
- Magento 1.9.1.1
- Magento 1.9.2.0
- Magento 1.9.2.1
- Magento 1.9.2.2
- Magento 2.0.0
- Magento 2.0.0-rc
- Magento 2.0.0-rc2