PT-2021-1885 · Adobe · Magento

Published 2021-01-12 · Updated 2022-08-19 · CVE-2021-21012

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Magento versions 2.4.1 and earlier Magento versions 2.4.0-p1 and earlier Magento versions 2.3.6 and earlier

Description The issue is related to an insecure direct object vulnerability (IDOR) in the checkout module. Successful exploitation could lead to sensitive information disclosure. The vulnerability is associated with deficiencies in the authorization mechanism, which could allow a remote attacker to gain unauthorized access to protected information.

Recommendations For Magento versions 2.4.1 and earlier, update to a version that includes a fix for the IDOR vulnerability in the checkout module. For Magento versions 2.4.0-p1 and earlier, update to a version that includes a fix for the IDOR vulnerability in the checkout module. For Magento versions 2.3.6 and earlier, update to a version that includes a fix for the IDOR vulnerability in the checkout module. As a temporary workaround, consider restricting access to the checkout module until a patch is available.

Fix

Incorrect Authorization

IDOR

Memory Corruption

Weakness Enumeration

CWE-863

CWE-639

CWE-787

Related Identifiers

BDU:2021-00655

BDU:2021-01089

CVE-2021-21012

Affected Products

Magento

References · 8

• https://bdu.fstec.ru/vul/2021-00655 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-21012 · Security Note
• https://helpx.adobe.com/security/products/magento/apsb21-08.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-01089 · Security Note
• https://osv.dev/vulnerability/CVE-2021-21012 · Vendor Advisory
• https://t.me/cvenotify/34812 · Telegram Post
• https://t.me/cvenotify/8691 · Telegram Post
• https://helpx.adobe.com/security/products/bridge/apsb21-07.html · Note