CVE-2021-36012
Magento Commerce Gift Card Business Logic Error
En bref Sévérité MEDIUM 6.5 EPSS EPSS 2.04 % · centile 81 (2026-10-27) État PUBLISHED Publiée 2021-09-01 Mise à jour 2024-09-17 Attribuée par adobe Statut NVD Modified Description Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a business logic error in the placeOrder graphql mutation. An authenticated attacker can leverage this vulnerability to altar the price of an item.
Scores Version Score Vecteur Évalué par CVSS 3.1 MEDIUM 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N adobe CVSS 3.1 MEDIUM 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N NVD · psirt@adobe.com (Secondary) CVSS 2.0 MEDIUM 4.0 AV:N/AC:L/Au:S/C:N/I:P/A:N NVD · nvd@nist.gov (Primary)
Faiblesses (CWE)
Avis GHSA-3f97-7pgv-gmgr — Magento affected by a business logic error in the placeOrder graphql mutationRéférences européennes
Avis du CERT-FR
Configurations affectées (CPE NVD) cpe:2.3:a:adobe:adobe_commerce:*:*:*:*:*:*:*:* ≥ 2.3.0 ≤ 2.3.7cpe:2.3:a:adobe:adobe_commerce:*:*:*:*:*:*:*:* ≥ 2.4.0 ≤ 2.4.2cpe:2.3:a:adobe:adobe_commerce:2.4.2:p1:*:*:*:*:*:*cpe:2.3:a:adobe:magento_open_source:*:*:*:*:*:*:*:* ≥ 2.3.0 ≤ 2.3.7cpe:2.3:a:adobe:magento_open_source:*:*:*:*:*:*:*:* ≥ 2.4.0 ≤ 2.4.2cpe:2.3:a:adobe:magento_open_source:2.4.2:p1:*:*:*:*:*:*Produits affectés Produit Versions Adobe · Magento Commerce affected unspecified ≤ 2.4.2 ; affected unspecified ≤ 2.4.2-p1 ; affected unspecified ≤ 2.3.7 ; affected unspecified ≤ None
Références
Sources
