It was possible to provide a parameter that resulted in the deletion of the currently logged-in user. If form key functionality was turned off, a malicious user could create a CSRF attack to delete the Admin user.
Part of patch MAGENTO 2.0.10 AND 2.1.2 SECURITY UPDATE
This vulnerability affects the following application versions:
- Magento 0.42.0-beta4
- Magento 0.42.0-beta5
- Magento 0.42.0-beta6
- Magento 0.42.0-beta7
- Magento 0.42.0-beta8
- Magento 0.42.0-beta9
- Magento 0.42.0-beta10
- Magento 0.42.0-beta11
- Magento 0.74.0-beta1
- Magento 0.74.0-beta2
- Magento 0.74.0-beta3
- Magento 0.74.0-beta4
- Magento 0.74.0-beta5
- Magento 0.74.0-beta6
- Magento 0.74.0-beta7
- Magento 0.74.0-beta8
- Magento 0.74.0-beta9
- Magento 0.74.0-beta10
- Magento 0.74.0-beta11
- Magento 0.74.0-beta12
- Magento 0.74.0-beta13
- Magento 0.74.0-beta14
- Magento 0.74.0-beta15
- Magento 0.74.0-beta16
- Magento 1.0.0-beta
- Magento 1.0.0-beta2
- Magento 1.0.0-beta3
- Magento 1.0.0-beta4
- Magento 1.0.0-beta5
- Magento 1.0.0-beta6
- Magento 2.0.0
- Magento 2.0.0-rc
- Magento 2.0.0-rc2
- Magento 2.0.1
- Magento 2.0.2
- Magento 2.0.3
- Magento 2.0.4
- Magento 2.0.5
- Magento 2.0.6
- Magento 2.0.7
- Magento 2.0.8
- Magento 2.0.9
- Magento 2.1.0
- Magento 2.1.0-rc1
- Magento 2.1.0-rc2
- Magento 2.1.0-rc3
- Magento 2.1.1