CVE-2021-21013: Incorrect Authorization

Magento versions 2.4.1 and earlier, 2.4.0-p1 and earlier and 2.3.6 and earlier are vulnerable to an insecure direct object vulnerability IDOR in the customer API module. Successful exploitation could lead to sensitive information disclosure and update arbitrary information on another user's accou...

Information Disclosure

Merchello.Web is vulnerable to information disclosure. A remote attacker is able to obtain and enumerate all customers' address via the customer API query...