An information leakage vulnerability exists in Magento 2.1 prior to 2.1.18, Magento 2.2 prior to 2.2.9, Magento 2.3 prior to 2.3.2. A SOAP web service endpoint does not properly enforce parameters related to access control. This could be abused to leak customer information via crafted SOAP requests.
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Magento | Magento | 2.1.0 (including) | 2.1.18 (excluding) |
| Magento | Magento | 2.2.0 (including) | 2.2.9 (excluding) |
| Magento | Magento | 2.3.0 (including) | 2.3.2 (excluding) |