GHSA-q9xx-4689-gvv5
Magento Unauthorized access to restricted resources
At a glance
- Published
- Updated
- CVE
- CVE-2021-28563
- Aliases
- BIT-magento-2021-28563
- CVSS_V3
- CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Description
Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are affected by an Improper Authorization vulnerability via the 'Create Customer' endpoint. Successful exploitation could lead to unauthorized modification of customer data by an unauthenticated attacker. Access to the admin console is required for successful exploitation.
Affected packages
| Package | Versions |
|---|---|
| Packagist · magento/community-edition | introduced 2.4.0, fixed 2.4.2-p1 |
| Packagist · magento/community-edition | introduced 0, fixed 2.3.7 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2021-28563 ADVISORY
- https://github.com/magento/magento2/commit/1bd5cb8c065e44779526c0b044ce19b884707695 WEB
- https://github.com/magento/magento2/commit/ed952726c94e401e922e88490e41a536f2d850e7 WEB
- https://github.com/magento/magento2 PACKAGE
- https://helpx.adobe.com/security/products/magento/apsb21-30.html WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |