Description
Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are affected by an Improper Authorization vulnerability via the 'Create Customer' endpoint. Successful exploitation could lead to unauthorized modification of customer data by an unauthenticated attacker. Access to the admin console is required for successful exploitation.
Analysis
No analysis available yet.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Adobe | Magento Commerce | affected |
|
Configuration 1 [-]
|
No data.
No data available yet.
Remediation
No remediation available yet.
Tracking
Sign in to view the affected projects.
Advisories
| Source | ID | Title |
|---|---|---|
 EUVD |
EUVD-2022-4939 | Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are affected by an Improper Authorization vulnerability via the 'Create Customer' endpoint. Successful exploitation could lead to unauthorized modification of customer data by an unauthenticated attacker. Access to the admin console is required for successful exploitation. |
 Github GHSA |
GHSA-q9xx-4689-gvv5 | Magento Unauthorized access to restricted resources |
References
History
No history.
MITRE
Status: PUBLISHED
Assigner: adobe
Published:
Updated: 2024-09-16T19:37:00.824Z
Reserved: 2021-03-16T00:00:00.000Z
Link: CVE-2021-28563
Vulnrichment
No data.
NVD
Status : Modified
Published: 2021-06-28T14:15:10.220
Modified: 2024-11-21T05:59:51.540
Link: CVE-2021-28563
Redhat
No data.
OpenCVE Enrichment
No data.
Weaknesses