Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2021-21013

Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to an insecure direct object vulnerability (IDOR) in the customer API module. Successful exploitation could lead to sensitive information disclosure and update arbitrary information on another user's account.

Published

2021-01-13T23:15:14.493

Last Modified

2024-11-21T05:47:24.187

Status

Modified

Source

[email protected]

Severity

CVSSv3.1: 8.1 (HIGH)

CVSSv2 Vector

AV:N/AC:L/Au:S/C:P/I:P/A:N

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: SINGLE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: PARTIAL
  • Availability Impact: NONE
Exploitability Score

8.0

Impact Score

4.9

Weaknesses
  • Type: Primary
    CWE-863
  • Type: Secondary
    CWE-639
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application adobe magento ≤ 2.4.1 Yes
Application adobe magento ≥ 2.4.1 Yes
References