CVE-2021-21022 — Authorization Bypass Through User-Controlled Key in Magento

CWE-639 — Authorization Bypass Through User-Controlled Key CWE-285 — Improper Authorization4 documents4 sources

Severity

5.3MEDIUMNVD

EPSS

0.2%

top 56.67%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Magento Magento Community-edition Adobe Magento Commerce +1 more

Timeline

PublishedFeb 11

Latest updateMay 24

Description

Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to an insecure direct object reference (IDOR) in the product module. Successful exploitation could lead to unauthorized access to restricted resources.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:NExploitability: 3.9 | Impact: 1.4

Affected Packages4 packages

▶NVDmagento/magento< 2.3.6+3

▶Packagistmagento/community-edition2.4.0 — 2.4.1-p1+1

▶CVEListV5adobe/magento_commerceunspecified — 2.4.1+3

▶Packagistmagento/project-community-edition2.0.2

🔴Vulnerability Details

OSV

Magento Insecure Direct Object Reference (IDOR) in the product module↗2022-05-24

▶

GHSA

Magento Insecure Direct Object Reference (IDOR) in the product module↗2022-05-24

▶

CVEList

Magento Commerce Incorrect permissions Could Lead To Unauthorized Access↗2021-02-11

▶