CVE-2021-21020 — Improper Access Control in Magento

CWE-284 — Improper Access Control4 documents4 sources
Severity
5.3MEDIUMNVD
EPSS
0.2%
top 64.31%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
MagentoMagento Community-editionAdobe Magento Commerce+1 more
Timeline
PublishedFeb 11
Latest updateMay 24

Description

Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to an access control bypass vulnerability in the Login as Customer module. Successful exploitation could lead to unauthorized access to restricted resources.

CVSS vector

CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:NExploitability: 1.6 | Impact: 3.6

Affected Packages4 packages

▶NVDmagento/magento< 2.3.6+3
▶Packagistmagento/community-edition2.4.0 — 2.4.1-p1+1
▶CVEListV5adobe/magento_commerceunspecified — 2.4.1+3

🔴Vulnerability Details

3
OSV
Magento Improper Access Control↗2022-05-24
▶
GHSA
Magento Improper Access Control↗2022-05-24
▶
CVEList
Magento Commerce Improper Access Control Vulnerability↗2021-02-11
▶
CVE-2021-21020 — Improper Access Control in Magento | cvebase