BIT-magento-2021-28567

See a problem?

Import Source

https://github.com/bitnami/vulndb/tree/main/data/magento/BIT-magento-2021-28567.json

JSON Data

https://api.osv.dev/v1/vulns/BIT-magento-2021-28567

Aliases

Published

2024-03-06T10:58:36.807Z

Modified

2026-03-20T10:00:19.141809Z

Summary

Magento Commerce improper authorization allows an authenticated user to perform certain functions without permission

Details

Magento versions 2.4.2 (and earlier), 2.4.1 (and earlier) and 2.3.6 (and earlier) are vulnerable to an Improper Authorization vulnerability in the customers module. Successful exploitation could allow a low-privileged user to modify customer data. Access to the admin console is required for successful exploitation.

Database specific

{
    "severity": "Medium",
    "cpes": [
        "cpe:2.3:a:magento:magento:*:*:*:*:commerce:*:*:*",
        "cpe:2.3:a:magento:magento:*:*:*:*:open_source:*:*:*"
    ]
}

References

Affected packages

Bitnami / magento

Package

Name: magento
Purl: pkg:bitnami/magento

Severity

6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N CVSS Calculator

Affected ranges

Type: SEMVER
Events: Introduced

0Unknown introduced version / All previous versions are affected

Fixed

2.4.3

Database specific

source

"https://github.com/bitnami/vulndb/tree/main/data/magento/BIT-magento-2021-28567.json"