The guest order view protection code made it possible to access guest order information for some orders. (This was due to how the code was generated and compared with stored values.) While the attack cannot target a specific order or allow a user to view all orders, it could be used to extract order information from store.
Part of patch MAGENTO 2.0.1 SECURITY UPDATE
This vulnerability affects the following application versions:
- Magento 2.0.0
- Magento 2.0.0-rc
- Magento 2.0.0-rc2