PT-2022-37712 · Packagist · Magento Community Edition+1

Published 2022-05-24 · Updated 2022-05-24

OSV

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability via the quoteId parameter. An attacker can abuse this vulnerability to disclose sensitive information.

Fix

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

GHSA-3G7M-G8QM-X6J5

Affected Products

Magento Community Edition

Magento/Project-Community-Edition

References · 4

• https://osv.dev/vulnerability/GHSA-3g7m-g8qm-x6j5 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-36039 · Security Note
• https://github.com/magento/magento2 · Note
• https://helpx.adobe.com/security/products/magento/apsb21-64.html · Note