PT-2022-37727 · Packagist · Magento Community Edition+1

Published 2022-05-24 · Updated 2022-05-24

OSV

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability in the Multishipping Module. An authenticated attacker could leverage this vulnerability to achieve sensitive information disclosure.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

GHSA-WGPR-9675-8R67

Affected Products

Magento Community Edition

Magento/Project-Community-Edition

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2021-36038 · Security Note
• https://osv.dev/vulnerability/GHSA-wgpr-9675-8r67 · Vendor Advisory
• https://github.com/magento/magento2 · Note
• https://helpx.adobe.com/security/products/magento/apsb21-64.html · Note