Magento Commerce Multishipping Module Improper Input Validation Could Lead To Information Exposure (Adobe Magento Commerce)
At a glance
- Source
- NVD
- EPSS
- EPSS 1.79 % · percentile 78 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- adobe
- NVD status
- Modified
Description
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability in the Multishipping Module. An authenticated attacker could leverage this vulnerability to achieve sensitive information disclosure.
Weaknesses (CWE)
- CWE-20 — Improper Input Validation
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N | adobe |
| CVSS 3.1 | MEDIUM 6.5 | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N | NVD · psirt@adobe.com (Secondary) |
| CVSS 2.0 | MEDIUM 4.0 | AV:N/AC:L/Au:S/C:P/I:N/A:N | NVD · nvd@nist.gov (Primary) |
Advisories
- GHSA-wgpr-9675-8r67 — Magento discloses sensitive information via the Multishipping Module
European references
- ENISA EUVD · EUVD-2021-22671
- GCVE · GCVE-0-2021-36038
CERT-FR advisories
- CERTFR-2021-AVI-609 — Multiples vulnérabilités dans Magento · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:a:adobe:adobe_commerce:*:*:*:*:*:*:*:*≥ 2.3.0 ≤ 2.3.7cpe:2.3:a:adobe:adobe_commerce:*:*:*:*:*:*:*:*≥ 2.4.0 ≤ 2.4.2cpe:2.3:a:adobe:adobe_commerce:2.4.2:p1:*:*:*:*:*:*cpe:2.3:a:adobe:magento_open_source:*:*:*:*:*:*:*:*≥ 2.3.0 ≤ 2.3.7cpe:2.3:a:adobe:magento_open_source:*:*:*:*:*:*:*:*≥ 2.4.0 ≤ 2.4.2cpe:2.3:a:adobe:magento_open_source:2.4.2:p1:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| Adobe · Magento Commerce | affected unspecified ≤ 2.4.2 ; affected unspecified ≤ 2.4.2-p1 ; affected unspecified ≤ 2.3.7 ; affected unspecified ≤ None |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |