CVE-2021-36012
Magento Commerce Gift Card Business Logic Error
At a glance Severity MEDIUM 6.5 EPSS EPSS 2.04 % · percentile 81 (2026-10-27) State PUBLISHED Published 2021-09-01 Updated 2024-09-17 Assigner adobe NVD status Modified Description Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a business logic error in the placeOrder graphql mutation. An authenticated attacker can leverage this vulnerability to altar the price of an item.
Scores Version Score Vector Scored by CVSS 3.1 MEDIUM 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N adobe CVSS 3.1 MEDIUM 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N NVD · psirt@adobe.com (Secondary) CVSS 2.0 MEDIUM 4.0 AV:N/AC:L/Au:S/C:N/I:P/A:N NVD · nvd@nist.gov (Primary)
Weaknesses (CWE)
Advisories GHSA-3f97-7pgv-gmgr — Magento affected by a business logic error in the placeOrder graphql mutationEuropean references
CERT-FR advisories
Affected configurations (NVD CPE) cpe:2.3:a:adobe:adobe_commerce:*:*:*:*:*:*:*:* ≥ 2.3.0 ≤ 2.3.7cpe:2.3:a:adobe:adobe_commerce:*:*:*:*:*:*:*:* ≥ 2.4.0 ≤ 2.4.2cpe:2.3:a:adobe:adobe_commerce:2.4.2:p1:*:*:*:*:*:*cpe:2.3:a:adobe:magento_open_source:*:*:*:*:*:*:*:* ≥ 2.3.0 ≤ 2.3.7cpe:2.3:a:adobe:magento_open_source:*:*:*:*:*:*:*:* ≥ 2.4.0 ≤ 2.4.2cpe:2.3:a:adobe:magento_open_source:2.4.2:p1:*:*:*:*:*:*Affected products Product Versions Adobe · Magento Commerce affected unspecified ≤ 2.4.2 ; affected unspecified ≤ 2.4.2-p1 ; affected unspecified ≤ 2.3.7 ; affected unspecified ≤ None
References
Sources
