CVE-2021-36032

Published Sep 1, 2021

Last updated 2 years ago

CVSS high 8.8

Overview

Description: Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability. An authenticated attacker can trigger an insecure direct object reference in the `V1/customers/me` endpoint to achieve information exposure and privilege escalation.
Source: psirt@adobe.com
NVD status: Analyzed

Risk scores

CVSS 3.1

Type: Primary
Base score: 8.8
Impact score: 5.9
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity: HIGH

CVSS 2.0

Type: Primary
Base score: 6.5
Impact score: 6.4
Exploitability score: 8
Vector string: AV:N/AC:L/Au:S/C:P/I:P/A:P

Weaknesses

nvd@nist.gov: CWE-639
psirt@adobe.com: CWE-20

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:adobe:adobe_commerce:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "72F005E6-8523-49FF-91F7-644BC737DDEF",
            "versionEndIncluding": "2.3.7",
            "versionStartIncluding": "2.3.0"
          },
          {
            "criteria": "cpe:2.3:a:adobe:adobe_commerce:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "260156B9-9CEF-4732-AD94-7D3CCD784F1D",
            "versionEndIncluding": "2.4.2",
            "versionStartIncluding": "2.4.0"
          },
          {
            "criteria": "cpe:2.3:a:adobe:adobe_commerce:2.4.2:p1:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "C711D725-10E3-4A9C-AAD8-9B1766CB42F0"
          },
          {
            "criteria": "cpe:2.3:a:adobe:magento_open_source:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "052A5E47-66AF-4F60-8949-E2B6CE98AEE9",
            "versionEndIncluding": "2.3.7",
            "versionStartIncluding": "2.3.0"
          },
          {
            "criteria": "cpe:2.3:a:adobe:magento_open_source:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "ADE9F2A6-575A-48DA-ACE4-B22ABB275B6B",
            "versionEndIncluding": "2.4.2",
            "versionStartIncluding": "2.4.0"
          },
          {
            "criteria": "cpe:2.3:a:adobe:magento_open_source:2.4.2:p1:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "8F768F94-34F1-4FB8-8D96-3BBC9D6B8C89"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

Overview

Risk scores

CVSS 3.1

CVSS 2.0

Weaknesses

Social media

Configurations

References