CVE-2021-36030

CWE-20 — Improper Input Validation4 documents4 sources
Severity
7.5HIGH
EPSS
1.4%
top 19.36%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
5
Magento Community-editionAdobe Magento CommerceAdobe Adobe Commerce+2 more
Timeline
PublishedSep 1
Latest updateMay 24

Description

Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability during the checkout process. An unauthenticated attacker can leverage this vulnerability to alter the price of items.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages5 packages

▶CVEListV5adobe/magento_commerceunspecified — 2.4.2+3
▶Packagistmagento/community-edition2.4.2-p1 — 2.4.2-p2+1
▶NVDadobe/adobe_commerce2.3.0 — 2.3.7+2
▶NVDadobe/magento_open_source2.3.0 — 2.3.7+2

Patches

Patch: helpx.adobe.com ↗Patch: helpx.adobe.com ↗

🔴Vulnerability Details

3
OSV
Magento allows attackers to alter the price of items↗2022-05-24
▶
GHSA
Magento allows attackers to alter the price of items↗2022-05-24
▶
CVEList
Magento Commerce Improper Input Validation During Checkout Process Could Lead To Privilege Escalation↗2021-09-01
▶
CVE-2021-36030 (HIGH CVSS 7.5) | Magento Commerce versions 2.4.2 (an | cvebase.io