Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are affected by a cross-site request forgery (CSRF) vulnerability via the GraphQL API. Successful exploitation could lead to unauthorized modification of customer metadata by an unauthenticated attacker. Access to the admin console is not required for successful exploitation.
References
| Link | Resource |
|---|---|
| https://helpx.adobe.com/security/products/magento/apsb21-08.html | Vendor Advisory |
Configurations
Configuration 1 (hide)
|
History
07 Nov 2023, 03:29
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : 4.3
v3 : unknown |
16 Feb 2021, 15:22
| Type | Values Removed | Values Added |
|---|---|---|
| CVSS |
v2 : v3 : |
v2 : 4.3
v3 : 4.3 |
| References | (MISC) https://helpx.adobe.com/security/products/magento/apsb21-08.html - Vendor Advisory | |
| CPE | cpe:2.3:a:magento:magento:2.4.1:-:*:*:open_source:*:*:* cpe:2.3:a:magento:magento:2.4.0:-:*:*:commerce:*:*:* cpe:2.3:a:magento:magento:*:*:*:*:commerce:*:*:* cpe:2.3:a:magento:magento:2.4.0:-:*:*:open_source:*:*:* cpe:2.3:a:magento:magento:2.4.0:p1:*:*:open_source:*:*:* cpe:2.3:a:magento:magento:*:*:*:*:open_source:*:*:* cpe:2.3:a:magento:magento:2.3.6:-:*:*:open_source:*:*:* cpe:2.3:a:magento:magento:2.3.6:-:*:*:commerce:*:*:* cpe:2.3:a:magento:magento:2.4.1:-:*:*:commerce:*:*:* cpe:2.3:a:magento:magento:2.4.0:p1:*:*:commerce:*:*:* |
11 Feb 2021, 20:53
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2021-02-11 20:15
Updated : 2023-12-10 13:41
NVD link : CVE-2021-21027
Mitre link : CVE-2021-21027
CVE.ORG link : CVE-2021-21027
JSON object : View
Products Affected
magento
- magento
CWE
CWE-352
Cross-Site Request Forgery (CSRF)