PT-2021-2186 · Adobe · Magento

Published 2021-02-09 · Updated 2024-03-06 · CVE-2021-21020

Positive Technologies (AI Summary)

CVSS v2.0

5.4

Medium

Base vector

AV:N/AC:H/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions: Magento versions 2.4.1 and earlier Magento versions 2.4.0-p1 and earlier Magento versions 2.3.6 and earlier

Description: The issue is related to an access control bypass vulnerability in the Login as Customer module. Successful exploitation could lead to unauthorized access to restricted resources. The vulnerability is associated with deficiencies in access control, which could allow a remote attacker to impact data integrity.

Recommendations: For versions 2.4.1 and earlier, update to a version that includes a fix for the access control bypass vulnerability in the Login as Customer module. For versions 2.4.0-p1 and earlier, update to a version that includes a fix for the access control bypass vulnerability in the Login as Customer module. For versions 2.3.6 and earlier, update to a version that includes a fix for the access control bypass vulnerability in the Login as Customer module. As a temporary workaround, consider disabling the Login as Customer module until a patch is available.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BDU:2021-01095

BIT-MAGENTO-2021-21020

CVE-2021-21020

GHSA-2J6V-829G-885Q

Affected Products

Magento

References · 8

• https://osv.dev/vulnerability/GHSA-2j6v-829g-885q · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-21020 · Vendor Advisory
• https://helpx.adobe.com/security/products/magento/apsb21-08.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-21020 · Security Note
• https://osv.dev/vulnerability/BIT-magento-2021-21020 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-01095 · Security Note
• https://github.com/magento/magento2 · Note
• https://t.me/cibsecurity/23468 · Telegram Post