Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
cve[email protected]CVE-2021-36032
HistorySep 01, 2021 - 3:15 p.m.

CVE-2021-36032

2021-09-0115:15:09
CWE-639
CWE-20
[email protected]
web.nvd.nist.gov
24
2
magento
commerce
cve-2021-36032
input validation
endpoint vulnerability
information exposure
privilege escalation

6.5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.3 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

50.3%

JSON

Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability. An authenticated attacker can trigger an insecure direct object reference in the V1/customers/me endpoint to achieve information exposure and privilege escalation.

Affected configurations

Vulners
NVD
Node
adobemagento_commerceRange≤2.4.2
OR
adobemagento_commerceRange≤2.4.2-p1
OR
adobemagento_commerceRange≤2.3.7
VendorProductVersionCPE
adobemagento_commerce*cpe:2.3:a:adobe:magento_commerce:*:*:*:*:*:*:*:*
adobemagento_commerce*cpe:2.3:a:adobe:magento_commerce:*:-p1:*:*:*:*:*:*
adobemagento_commerce*cpe:2.3:a:adobe:magento_commerce:*:*:*:*:*:*:*:*

CNA Affected

[
  {
    "product": "Magento Commerce",
    "vendor": "Adobe",
    "versions": [
      {
        "lessThanOrEqual": "2.4.2",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "2.4.2-p1",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "2.3.7",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "None",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

Social References

More

Related

prion 1
osv 1
cvelist 2
nvd 1
cnvd 1
cve 1
thn 1
adobe 1
prion
prion
Input validation
2021-09-01 15:15:00
osv
osv
CVE-2021-36032
2021-09-01 15:15:09
cvelist
cvelist
CVE-2021-36032 Magento Commerce Improper Input Validation Could Lead To Information Exposure and Privilege Escalation
2021-08-10 00:00:00
CVE-2022-42344 [CVE-2021-36032] Magento IDOR Leads to Account Takeover
2022-10-20 00:00:00
nvd
nvd
CVE-2021-36032
2021-09-01 15:15:09
cnvd
cnvd
Adobe Magento Input Validation Error Vulnerability (CNVD-2021-102808)
2021-08-11 00:00:00
cve
cve
CVE-2022-42344
2022-10-20 17:15:10
thn
thn
Magento Update Released to Fix Critical Flaws Affecting E-Commerce Sites
2021-08-11 06:28:00
adobe
adobe
APSB21-64 Security updates available for Magento
2021-08-10 00:00:00

6.5 Medium

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:S/C:P/I:P/A:P

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.3 High

AI Score

Confidence

High

0.001 Low

EPSS

Percentile

50.3%

JSON
Related for CVE-2021-36032
prion1osv1cvelist2nvd1cnvd1cve1thn1adobe1