CVE-2021-36039

CVE-2021-36039 affects Magento Commerce: improper input validation via the quoteId parameter can lead to information disclosure. Affected: Magento Commerce editions 2.4.2 and earlier, 2.4.2-p1 and earlier, and 2.3.7 and earlier. The vulnerability is described as allowing an attacker to disclose s...

CVE-2021-36039 Magento Commerce `quoteId` parameter Incorrect Authorization Vulnerability Could Lead To Information Disclosure

Magento Commerce versions 2.4.2 and earlier, 2.4.2-p1 and earlier and 2.3.7 and earlier are affected by an improper input validation vulnerability via the quoteId parameter. An attacker can abuse this vulnerability to disclose sensitive information...

CVE-2021-36029

Magento Commerce vulnerabilities (CVE-2021-36029) affect versions 2.4.2 and earlier, 2.4.2-p1 and earlier, and 2.3.7 and earlier. The issue is improper authorization that could allow an attacker with admin privileges to perform remote code execution. Connected advisories confirm this is a Magento...

CVE-2021-36029 Magento Commerce Improper Authorization Vulnerability Could Lead To Remote Code Execution

Magento Commerce versions 2.4.2 and earlier, 2.4.2-p1 and earlier and 2.3.7 and earlier are affected by an improper improper authorization vulnerability. An attacker with admin privileges could leverage this vulnerability to achieve remote code execution...

CVE-2021-36026 Magento Commerce Stored Cross-site Scripting Vulnerability

Magento Commerce versions 2.4.2 and earlier, 2.4.2-p1 and earlier and 2.3.7 and earlier are affected by a stored cross-site scripting vulnerability in the customer address upload feature that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious...

CVE-2021-36026

Magento Commerce stored cross-site scripting (XSS) in the customer address upload feature affects Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier), and 2.3.7 (and earlier). The vulnerability allows an attacker to inject malicious JavaScript into vulnerable form fields, which ...

CVE-2021-36032 Magento Commerce Improper Input Validation Could Lead To Information Exposure and Privilege Escalation

Magento Commerce versions 2.4.2 and earlier, 2.4.2-p1 and earlier and 2.3.7 and earlier are affected by an improper input validation vulnerability. An authenticated attacker can trigger an insecure direct object reference in the V1/customers/me endpoint to achieve information exposure and privile...

CVE-2021-36032

Magento Commerce is affected by CVE-2021-36032, an improper input validation vulnerability leading to an insecure direct object reference in the V1/customers/me endpoint. The issue allows an authenticated attacker to access information and escalate privileges within Magento Commerce versions 2.4....

CVE-2021-36038

Magento Commerce prior to 2.4.3 and 2.3.x are affected by CVE-2021-36038 due to an improper input validation vulnerability in the Multishipping Module. An authenticated attacker could use this vulnerability to disclose sensitive information. Affected versions include 2.4.2 and earlier, 2.4.2-p1 a...

CVE-2021-36038 Magento Commerce Multishipping Module Improper Input Validation Could Lead To Information Exposure

Magento Commerce versions 2.4.2 and earlier, 2.4.2-p1 and earlier and 2.3.7 and earlier are affected by an improper input validation vulnerability in the Multishipping Module. An authenticated attacker could leverage this vulnerability to achieve sensitive information disclosure...

CVE-2021-36028 Magento Commerce XML Injection Vulnerability Could Lead To Remote Code Execution

Magento Commerce versions 2.4.2 and earlier, 2.4.2-p1 and earlier and 2.3.7 and earlier are affected by an XML Injection vulnerability when saving a configurable product. An attacker with admin privileges can trigger a specially crafted script to achieve remote code execution...

CVE-2021-36028

CVE-2021-36028 (Magento Commerce) is an XML Injection vulnerability affecting Magento versions 2.4.2 and earlier, 2.4.2-p1 and earlier, and 2.3.7 and earlier. The root cause is XML injection when saving a configurable product. An attacker with admin privileges can trigger a crafted script to achi...

CVE-2021-36034

Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability that allows remote code execution via a specially crafted file uploaded by an attacker with admin privileges. The issue stems from insufficient ...

CVE-2021-36034 Magento Commerce Improper Input Validation Could Lead To Remote Code Execution

Magento Commerce versions 2.4.2 and earlier, 2.4.2-p1 and earlier and 2.3.7 and earlier are affected by an improper input validation vulnerability. An attacker with admin privileges can upload a specially crafted file to achieve remote code execution...

CVE-2021-36022 Magento Commerce Widgets Update Layout XML Injection Vulnerability Could Lead To Remote Code Execution

Magento Commerce versions 2.4.2 and earlier, 2.4.2-p1 and earlier and 2.3.7 and earlier are affected by an XML Injection vulnerability in the Widgets Update Layout. An attacker with admin privileges can trigger a specially crafted script to achieve remote code execution...

CVE-2021-36022

Magento Commerce is affected by an XML Injection vulnerability in the Widgets Update Layout across versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier), and 2.3.7 (and earlier). The underlying issue allows an attacker with admin privileges to trigger a crafted script that achieves remote code exe...

CVE-2021-36033

CVE-2021-36033 refers to an XML Injection in the Magento Commerce Widgets Module. Affected software includes Magento Commerce versions 2.4.2 and earlier, 2.4.2-p1 and earlier, and 2.3.7 and earlier. The vulnerability allows an attacker with administrative privileges to submit specially crafted XM...

CVE-2021-36033 Magento Commerce Widgets Module XML Injection Vulnerability Could Lead To Remote Code Execution

Magento Commerce versions 2.4.2 and earlier, 2.4.2-p1 and earlier and 2.3.7 and earlier are affected by an XML Injection vulnerability in the Widgets Module. An attacker with admin privileges can trigger a specially crafted script to achieve remote code execution...

CVE-2021-36037

CVE-2021-36037 affects Magento Commerce: Magento Commerce 2.4.2 (and earlier), 2.4.2-p1 (and earlier), and 2.3.7 (and earlier) are impacted by an improper authorization vulnerability that could allow an authenticated attacker to obtain sensitive information disclosure . The issue is described in ...

CVE-2021-36037 Magento Commerce Improper Authorization Vulnerability Could Lead To Information Exposure

Magento Commerce versions 2.4.2 and earlier, 2.4.2-p1 and earlier and 2.3.7 and earlier are affected by an improper improper authorization vulnerability. An authenticated attacker could leverage this vulnerability to achieve sensitive information disclosure...