PT-2021-6288 · Adobe · Magento Commerce

Published 2021-08-11 · Updated 2022-05-24 · CVE-2021-36030

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Magento Commerce versions 2.4.2 and earlier Magento Commerce versions 2.4.2-p1 and earlier Magento Commerce versions 2.3.7 and earlier

Description The issue is related to improper input validation during the checkout process. An unauthenticated attacker can exploit this to alter the price of items. The vulnerability exists due to insufficient input validation, which can allow a remote attacker to bypass existing security restrictions.

Recommendations For Magento Commerce versions 2.4.2 and earlier, update to a version that includes the fix for this issue. For Magento Commerce versions 2.4.2-p1 and earlier, update to a version that includes the fix for this issue. For Magento Commerce versions 2.3.7 and earlier, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the checkout process until a patch is available.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2022-01260

CVE-2021-36030

GHSA-RHFF-65HP-55RW

Affected Products

Magento Commerce

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2021-36030 · Security Note
• https://helpx.adobe.com/security/products/magento/apsb21-64.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-01260 · Security Note
• https://osv.dev/vulnerability/GHSA-rhff-65hp-55rw · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-36030 · Vendor Advisory
• https://github.com/magento/magento2 · Note