Vulnerability · Published Jan 13, 2021 · Assigned by adobe
CVE-2021-21013Magento Commerce Insecure Direct Object Reference Could Lead To Information Disclosure
High 8.1
In plain English
A high-severity incorrect authorization in Magento Commerce from Adobe. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.2% (higher than 88% of all known vulnerabilities).
Severity (CVSS 3.1)8.1High
Exploit odds (30 days)3.2%top 11.7% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack toolingNoneno public tooling known
Official description
Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to an insecure direct object vulnerability (IDOR) in the customer API module. Successful exploitation could lead to sensitive information disclosure and update arbitrary information on another user's account.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Adobe | Magento Commerce | unspecified – through 2.4.1unspecified – through 2.4.0-p1unspecified – through 2.3.6unspecified – through None |
Weakness: CWE-863 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
References
- https://helpx.adobe.com/security/products/magento/apsb21-08.html x_refsource_MISC