CVE-2021-28563
28.06.2021, 14:15
Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are affected by an Improper Authorization vulnerability via the 'Create Customer' endpoint. Successful exploitation could lead to unauthorized modification of customer data by an unauthenticated attacker. Access to the admin console is required for successful exploitation.Enginsight
Affected Products (NVD)
| Vendor | Product | Version |
|---|---|---|
| magento | magento | 𝑥 < 2.3.7 |
| magento | magento | 𝑥 < 2.3.7 |
| magento | magento | 2.4.0 ≤ 𝑥 ≤ 2.4.2 |
| magento | magento | 2.4.0 ≤ 𝑥 ≤ 2.4.2 |
𝑥
= Vulnerable software versions
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
| Vendor | Product | Version | Source |
|---|---|---|---|
| adobe | magento_commerce | 𝑥 ≤ 2.4.2 | CNA |
Common Weakness Enumeration