4.3

CVE-2021-21012

Magento Commerce Insecure Direct Object Reference Vulnerability Could Lead To Sensitive Information Disclosure

Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to an insecure direct object vulnerability (IDOR) in the checkout module. Successful exploitation could lead to sensitive information disclosure.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Adobe ≫ Magento Commerce Version <= 2.3.6
Adobe ≫ Magento Commerce Version 2.4.0
Adobe ≫ Magento Commerce Version 2.4.0 Update p1
Adobe ≫ Magento Commerce Version 2.4.1
Adobe ≫ Magento Open Source Version <= 2.3.6
Adobe ≫ Magento Open Source Version 2.4.0
Adobe ≫ Magento Open Source Version 2.4.0 Update p1
Adobe ≫ Magento Open Source Version 2.4.1
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 3.95% 0.891
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:P/I:N/A:N
Adobe 5.3 3.9 1.4
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CWE-639 Authorization Bypass Through User-Controlled Key

The system's authorization functionality does not prevent one user from gaining access to another user's data or record by modifying the key value identifying the data.

https://helpx.adobe.com/security/products/magento/apsb21-08.html
Vendor Advisory
Release Notes