Magento did not validate the form key when deleting items from the shopping cart using a GET request. As a result, a user could use phishing emails or other malicious attacks to trick a customer into deleting items from his/her cart.
Part of patch MAGENTO 2.0.1 SECURITY UPDATE
This vulnerability affects the following application versions:
- Magento 0.74.0-beta15
- Magento 0.74.0-beta16
- Magento 1.0.0-beta
- Magento 1.0.0-beta2
- Magento 1.0.0-beta3
- Magento 1.0.0-beta4
- Magento 1.0.0-beta5
- Magento 1.0.0-beta6
- Magento 2.0.0
- Magento 2.0.0-rc
- Magento 2.0.0-rc2