A cross-site request forgery vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. This can result in unintended deletion of user roles.
| Package (Ecosystem) | Introduced | Fixed | Limit |
|---|---|---|---|
| magento/community-edition(Packagist) | 2.1.0 | 2.1.18 | N/A |
| magento/community-edition(Packagist) | 2.2.0 | 2.2.9 | N/A |
| magento/community-edition(Packagist) | 2.3.0 | 2.3.2 | N/A |
CVSS Metrics
