CVE-2021-28585

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2021-28585

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-28585.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2021-28585

Aliases

Published

2021-06-28T14:15:11.477Z

Modified

2026-07-08T23:57:33.771900Z

Severity

5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVSS Calculator

Summary

[none]

Details

Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are affected by an Improper input validation vulnerability in the New customer WebAPI.Successful exploitation could allow an attacker to send unsolicited spam e-mails.

References

https://helpx.adobe.com/security/products/magento/apsb21-30.html

Affected packages

Git / github.com/magento/devdocs

Affected ranges

Type

GIT

Repo

https://github.com/magento/devdocs

Events

Introduced

Fixed

9eba2c99bed83d8297c03b7ea3b110500cc5b955

Introduced

9eba2c99bed83d8297c03b7ea3b110500cc5b955

Last affected

9eba2c99bed83d8297c03b7ea3b110500cc5b955

Database specific

{
    "cpe": [
        "cpe:2.3:a:magento:magento:*:*:*:*:commerce:*:*:*",
        "cpe:2.3:a:magento:magento:*:*:*:*:open_source:*:*:*",
        "cpe:2.3:a:magento:magento:2.3.6:-:*:*:commerce:*:*:*",
        "cpe:2.3:a:magento:magento:2.3.6:-:*:*:open_source:*:*:*",
        "cpe:2.3:a:magento:magento:2.3.6:p1:*:*:commerce:*:*:*",
        "cpe:2.3:a:magento:magento:2.3.6:p1:*:*:open_source:*:*:*",
        "cpe:2.3:a:magento:magento:2.4.1:-:*:*:commerce:*:*:*",
        "cpe:2.3:a:magento:magento:2.4.1:-:*:*:open_source:*:*:*",
        "cpe:2.3:a:magento:magento:2.4.1:p1:*:*:commerce:*:*:*",
        "cpe:2.3:a:magento:magento:2.4.1:p1:*:*:open_source:*:*:*",
        "cpe:2.3:a:magento:magento:2.4.2:*:*:*:commerce:*:*:*",
        "cpe:2.3:a:magento:magento:2.4.2:*:*:*:open_source:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.3.6"
        },
        {
            "introduced": "2.3.6-NA"
        },
        {
            "last_affected": "2.3.6-NA"
        },
        {
            "introduced": "2.3.6-p1"
        },
        {
            "last_affected": "2.3.6-p1"
        },
        {
            "introduced": "2.4.1-NA"
        },
        {
            "last_affected": "2.4.1-NA"
        },
        {
            "introduced": "2.4.1-p1"
        },
        {
            "last_affected": "2.4.1-p1"
        },
        {
            "introduced": "2.4.2"
        },
        {
            "last_affected": "2.4.2"
        }
    ],
    "source": [
        "CPE_RANGE",
        "CPE_STRING"
    ]
}

Affected versions

1.*

1.x-eos

2.*

2.0.8

2.1.14

2.1.15

2.1.16

2.1.17

2.1.18

2.2.11

2.2.5

2.2.6

2.2.7

2.2.8

2.2.9

2.3.0

2.3.1

2.3.2

2.3.3-p1

2.3.4

2.3.5

2.3.6-NA

2.3.6-p1

2.4.1-p1

2.4.2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-28585.json"

Git / github.com/magento/magento2

Affected ranges

Type

GIT

Repo

https://github.com/magento/magento2

Events

Introduced

Fixed

53ad434d78cd2d357203fb82e5ea059883f403b8

Introduced

53ad434d78cd2d357203fb82e5ea059883f403b8

Last affected

33242e4b19cf207d7b73f7791ef894b48bb41f8a

Database specific

{
    "cpe": [
        "cpe:2.3:a:magento:magento:*:*:*:*:commerce:*:*:*",
        "cpe:2.3:a:magento:magento:*:*:*:*:open_source:*:*:*",
        "cpe:2.3:a:magento:magento:2.3.6:-:*:*:commerce:*:*:*",
        "cpe:2.3:a:magento:magento:2.3.6:-:*:*:open_source:*:*:*",
        "cpe:2.3:a:magento:magento:2.3.6:p1:*:*:commerce:*:*:*",
        "cpe:2.3:a:magento:magento:2.3.6:p1:*:*:open_source:*:*:*",
        "cpe:2.3:a:magento:magento:2.4.1:-:*:*:commerce:*:*:*",
        "cpe:2.3:a:magento:magento:2.4.1:-:*:*:open_source:*:*:*",
        "cpe:2.3:a:magento:magento:2.4.1:p1:*:*:commerce:*:*:*",
        "cpe:2.3:a:magento:magento:2.4.1:p1:*:*:open_source:*:*:*",
        "cpe:2.3:a:magento:magento:2.4.2:*:*:*:commerce:*:*:*",
        "cpe:2.3:a:magento:magento:2.4.2:*:*:*:open_source:*:*:*"
    ],
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "2.3.6"
        },
        {
            "introduced": "2.3.6-NA"
        },
        {
            "last_affected": "2.3.6-NA"
        },
        {
            "introduced": "2.3.6-p1"
        },
        {
            "last_affected": "2.3.6-p1"
        },
        {
            "introduced": "2.4.1-NA"
        },
        {
            "last_affected": "2.4.1-NA"
        },
        {
            "introduced": "2.4.1-p1"
        },
        {
            "last_affected": "2.4.1-p1"
        },
        {
            "introduced": "2.4.2"
        },
        {
            "last_affected": "2.4.2"
        }
    ],
    "source": [
        "CPE_RANGE",
        "CPE_STRING"
    ]
}

Affected versions

0.*

0.1.0-alpha100

0.1.0-alpha101

0.1.0-alpha102

0.1.0-alpha103

0.1.0-alpha104

0.1.0-alpha105

0.1.0-alpha106

0.1.0-alpha107

0.1.0-alpha108

0.1.0-alpha89

0.1.0-alpha90

0.1.0-alpha91

0.1.0-alpha92

0.1.0-alpha93

0.1.0-alpha94

0.1.0-alpha95

0.1.0-alpha96

0.1.0-alpha97

0.1.0-alpha98

0.1.0-alpha99

0.42.0-beta1

0.42.0-beta3

0.74.0-beta1

2.*

2.0.0

2.0.0-rc

2.1.0

2.1.0-rc1

2.1.0-rc2

2.1.0-rc3

2.2.0-RC1.1

2.2.0-RC1.2

2.2.0-RC1.3

2.3.6-NA

2.3.6-p1

2.4.1-NA

2.4.1-p1

2.4.2

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-28585.json"