GHSA-8pfq-g48p-x7w8
Magento Insecure Direct Object Reference (IDOR) in the product module
At a glance
- Published
- Updated
- CVE
- CVE-2021-21022
- Aliases
- BIT-magento-2021-21022
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Description
Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to an insecure direct object reference (IDOR) in the product module. Successful exploitation could lead to unauthorized access to restricted resources.
Affected packages
| Package | Versions |
|---|---|
| Packagist · magento/community-edition | introduced 0, fixed 2.3.6-p1 |
| Packagist · magento/community-edition | introduced 2.4.0, fixed 2.4.1-p1 |
| Packagist · magento/project-community-edition | introduced 0, last affected 2.0.2 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2021-21022 ADVISORY
- https://github.com/magento/magento2 PACKAGE
- https://helpx.adobe.com/security/products/magento/apsb21-08.html WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |