CVE-2021-21012

Published: Jan 13, 2021Modified: Nov 21, 2024

5.3

Vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Exploitability: 3.9 / Impact: 1.4

Source: psirt@adobe.com (Secondary)

Description

Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to an insecure direct object vulnerability (IDOR) in the checkout module. Successful exploitation could lead to sensitive information disclosure.

Affected (8)

Products: Adobe: Magento Commerce, Magento Open Source

Adobe

2 products

Magento Commerce

Magento Open Source

Configuration A

8 vulnerable

Vulnerable Software	Affected Versions
Adobe Magento Commerce	Up to 2.3.6
Adobe Magento Commerce	Version 2.4.0
Adobe Magento Commerce	Version 2.4.0 p1
Adobe Magento Commerce	Version 2.4.1
Adobe Magento Open Source	Up to 2.3.6
Adobe Magento Open Source	Version 2.4.0
Adobe Magento Open Source	Version 2.4.0 p1
Adobe Magento Open Source	Version 2.4.1

Related CWEs

CWE-639

Authorization Bypass Through User-Controlled Key

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

References (2)

https://helpx.adobe.com/security/products/magento/apsb21-08.html

Source: psirt@adobe.com

Release NotesVendor Advisory

https://helpx.adobe.com/security/products/magento/apsb21-08.html

Source: af854a3a-2127-422b-91ae-364da2661108

Release NotesVendor Advisory

Timeline

No history available yet.