Lucene search

AdobeCVE-2021-36039

HistorySep 01, 2021 - 3:15 p.m.

CVE-2021-36039

2021-09-0115:15:10

CWE-863

adobe

web.nvd.nist.gov

magento

commerce

2.4.2

2.4.2-p1

2.3.7

input validation

vulnerability

cve-2021-36039

nvd

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

6.2

Confidence

High

EPSS

0.001

Percentile

31.5%

JSON

Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability via the quoteId parameter. An attacker can abuse this vulnerability to disclose sensitive information.

Affected configurations

Nvd

Vulners

Node

adobeadobe_commerceRange2.3.0–2.3.7

adobeadobe_commerceRange2.4.0–2.4.2

adobeadobe_commerceMatch2.4.2p1

adobemagento_open_sourceRange2.3.0–2.3.7

adobemagento_open_sourceRange2.4.0–2.4.2

adobemagento_open_sourceMatch2.4.2p1

VendorProductVersionCPE
adobeadobe_commerce*cpe:2.3:a:adobe:adobe_commerce:*:*:*:*:*:*:*:*
adobeadobe_commerce2.4.2cpe:2.3:a:adobe:adobe_commerce:2.4.2:p1:*:*:*:*:*:*
adobemagento_open_source*cpe:2.3:a:adobe:magento_open_source:*:*:*:*:*:*:*:*
adobemagento_open_source2.4.2cpe:2.3:a:adobe:magento_open_source:2.4.2:p1:*:*:*:*:*:*

Vendor	Product	Version	CPE
adobe	adobe_commerce	*	cpe:2.3:a:adobe:adobe_commerce::::::::
adobe	adobe_commerce	2.4.2	cpe:2.3:a:adobe:adobe_commerce:2.4.2:p1::::::
adobe	magento_open_source	*	cpe:2.3:a:adobe:magento_open_source::::::::
adobe	magento_open_source	2.4.2	cpe:2.3:a:adobe:magento_open_source:2.4.2:p1::::::

CNA Affected

[
  {
    "product": "Magento Commerce",
    "vendor": "Adobe",
    "versions": [
      {
        "lessThanOrEqual": "2.4.2",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "2.4.2-p1",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "2.3.7",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "None",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

References

helpx.adobe.com/security/products/magento/apsb21-64.html

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:L/Au:S/C:P/I:N/A:N

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

AI Score

6.2

Confidence

High

EPSS

0.001

Percentile

31.5%

JSON

Related for CVE-2021-36039