Lack of CSRF protection and privilege check allows any Admin user to create a backup of the system. An Admin user could be tricked into clicking on a phishing form that creates a backup, or an Admin user with lesser privileges can access this functionality. This attack has a low risk because creating a backup in itself does not harm the installation.
Part of patch MAGENTO 2.0.10 AND 2.1.2 SECURITY UPDATE
This vulnerability affects the following application versions:
- Magento 2.0.0
- Magento 2.0.1
- Magento 2.0.2
- Magento 2.0.3
- Magento 2.0.4
- Magento 2.0.5
- Magento 2.0.6
- Magento 2.0.7
- Magento 2.0.8
- Magento 2.0.9
- Magento 2.1.0