Insecure authentication and session management vulnerability exists in Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An unauthenticated user can append arbitrary session id that will not be invalidated by subsequent authentication.
According to WASC, “Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization.”
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Magento | Magento | 2.2.0 (including) | 2.2.10 (excluding) |
| Magento | Magento | 2.3.0 (including) | 2.3.2 (excluding) |
| Magento | Magento | 2.3.2 (including) | 2.3.2 (including) |