PT-2022-37726 · Packagist · Magento Community Edition+1

Published 2022-05-24 · Updated 2022-05-24

OSV

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper authorization vulnerability. An authenticated attacker could leverage this vulnerability to achieve sensitive information disclosure.

Fix

Improper Authorization

Incorrect Authorization

Weakness Enumeration

CWE-285

CWE-863

Related Identifiers

GHSA-VRQ2-W7R7-3FP2

Affected Products

Magento Community Edition

Magento/Project-Community-Edition

References · 4

• https://osv.dev/vulnerability/GHSA-vrq2-w7r7-3fp2 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-36037 · Security Note
• https://github.com/magento/magento2 · Note
• https://helpx.adobe.com/security/products/magento/apsb21-64.html · Note