CVE-2021-21020

Published Feb 11, 2021

Last updated a year ago

Overview

Description: Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to an access control bypass vulnerability in the Login as Customer module. Successful exploitation could lead to unauthorized access to restricted resources.
Source: psirt@adobe.com
NVD status: Modified

Hype score: Not currently trending

Risk scores

CVSS 3.0

Type: Secondary
Base score: 5.3
Impact score: 3.6
Exploitability score: 1.6
Vector string: CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N
Severity: MEDIUM

CVSS 2.0

Type: Primary
Base score: 4.3
Impact score: 2.9
Exploitability score: 8.6
Vector string: AV:N/AC:M/Au:N/C:N/I:P/A:N

Weaknesses

nvd@nist.gov: NVD-CWE-Other
psirt@adobe.com: CWE-284

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:magento:magento:*:*:*:*:commerce:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "14B6B496-E849-4935-B3D8-8BDB8DDD59A3",
            "versionEndExcluding": "2.3.6"
          },
          {
            "criteria": "cpe:2.3:a:magento:magento:*:*:*:*:open_source:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "79C3A2B0-AE14-4D0F-BEE2-82FC00BE6087",
            "versionEndExcluding": "2.3.6"
          },
          {
            "criteria": "cpe:2.3:a:magento:magento:2.3.6:-:*:*:commerce:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "F9C60780-1213-4D06-A4C4-CC915C952B7B"
          },
          {
            "criteria": "cpe:2.3:a:magento:magento:2.3.6:-:*:*:open_source:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "3CCEDD72-7195-495C-A9B6-9D18BA9756F7"
          },
          {
            "criteria": "cpe:2.3:a:magento:magento:2.4.0:-:*:*:commerce:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "05F799AA-CDC0-409F-BB7E-CB941D6FB189"
          },
          {
            "criteria": "cpe:2.3:a:magento:magento:2.4.0:-:*:*:open_source:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "600AA27A-D2A8-41C3-8631-74ECF7453E78"
          },
          {
            "criteria": "cpe:2.3:a:magento:magento:2.4.0:p1:*:*:commerce:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "67683B07-34CD-4DD2-A6C9-C71733007397"
          },
          {
            "criteria": "cpe:2.3:a:magento:magento:2.4.0:p1:*:*:open_source:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "ECA32B69-E9D8-4C01-ACDC-E0F885D937FB"
          },
          {
            "criteria": "cpe:2.3:a:magento:magento:2.4.1:-:*:*:commerce:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "80860D39-0D51-47B3-BA92-F473ADA1BBC3"
          },
          {
            "criteria": "cpe:2.3:a:magento:magento:2.4.1:-:*:*:open_source:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "2ADFE661-AB9C-4387-AC4F-D14A0717C2B8"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

Overview

Social media

Risk scores

CVSS 3.0

CVSS 2.0

Weaknesses

Configurations

References