Magento no longer allows authenticated customers to change other customers’ account information using either SOAP or REST calls. Magento now confirms that the ID of the customer whose account is being edited matches the authentication token in use. Previously, a malicious user could hijack a customer account by logging in as an authenticated user, then editing the account of any other user. (The SOAP and REST APIs are enabled by default in most installations.)
Part of patch MAGENTO 2.0.6 SECURITY UPDATE
This vulnerability affects the following application versions:
- Magento 0.74.0-beta13
- Magento 0.74.0-beta14
- Magento 0.74.0-beta15
- Magento 0.74.0-beta16
- Magento 1.0.0-beta
- Magento 1.0.0-beta2
- Magento 1.0.0-beta3
- Magento 1.0.0-beta4
- Magento 1.0.0-beta5
- Magento 1.0.0-beta6
- Magento 2.0.0
- Magento 2.0.0-rc
- Magento 2.0.0-rc2
- Magento 2.0.1
- Magento 2.0.2
- Magento 2.0.3
- Magento 2.0.4
- Magento 2.0.5