Magento Commerce improper Authorization via the 'Create Customer' endpoint (Adobe Magento Commerce)
En bref
- Source
- NVD
- EPSS
- EPSS 1.43 % · centile 73 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- adobe
- Statut NVD
- Modified
Description
Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are affected by an Improper Authorization vulnerability via the 'Create Customer' endpoint. Successful exploitation could lead to unauthorized modification of customer data by an unauthenticated attacker. Access to the admin console is required for successful exploitation.
Faiblesses (CWE)
- CWE-285 — Autorisation incorrecte
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 6.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N | adobe |
| CVSS 3.1 | MEDIUM 6.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N | NVD · psirt@adobe.com (Secondary) |
| CVSS 3.1 | MEDIUM 6.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N | NVD · nvd@nist.gov (Primary) |
| CVSS 2.0 | MEDIUM 6.4 | AV:N/AC:L/Au:N/C:P/I:P/A:N | NVD · nvd@nist.gov (Primary) |
Avis
- GHSA-q9xx-4689-gvv5 — Magento Unauthorized access to restricted resources
Références européennes
- ENISA EUVD · EUVD-2022-4939
- GCVE · GCVE-0-2021-28563
Avis du CERT-FR
- CERTFR-2021-AVI-376 — Multiples vulnérabilités dans Magento · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:magento:magento:*:*:*:*:commerce:*:*:*< 2.3.7cpe:2.3:a:magento:magento:*:*:*:*:open_source:*:*:*< 2.3.7cpe:2.3:a:magento:magento:*:*:*:*:commerce:*:*:*≥ 2.4.0 ≤ 2.4.2cpe:2.3:a:magento:magento:*:*:*:*:open_source:*:*:*≥ 2.4.0 ≤ 2.4.2
Produits affectés
| Produit | Versions |
|---|---|
| Adobe · Magento Commerce | affected unspecified ≤ 2.4.2 ; affected unspecified ≤ 2.3.6-p1 ; affected unspecified ≤ 2.4.1-p1 ; affected unspecified ≤ None |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |