CVE-2021-28567 — Improper Authorization in Magento Community-edition

CWE-285 — Improper AuthorizationCWE-863 — Incorrect Authorization4 documents4 sources
Severity
6.5MEDIUMNVD
EPSS
0.1%
top 71.77%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Magento Community-editionAdobe Magento CommerceMagento+1 more
Timeline
PublishedSep 8
Latest updateMay 24

Description

Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are vulnerable to an Improper Authorization vulnerability in the customers module. Successful exploitation could allow a low-privileged user to modify customer data. Access to the admin console is required for successful exploitation.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:NExploitability: 2.8 | Impact: 3.6

Affected Packages4 packages

▶Packagistmagento/community-edition2.4.0 — 2.4.2-p1+1
▶NVDmagento/magento2.4.2
▶CVEListV5adobe/magento_commerceunspecified — 2.4.2+3

🔴Vulnerability Details

3
GHSA
Magento Improper Authorization vulnerability in the customers module↗2022-05-24
▶
OSV
Magento Improper Authorization vulnerability in the customers module↗2022-05-24
▶
CVEList
Magento Commerce improper authorization allows an authenticated user to perform certain functions without permission↗2021-09-08
▶
CVE-2021-28567 — Improper Authorization in Magento | cvebase