CVE-2021-28563

Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are affected by an Improper Authorization vulnerability via the 'Create Customer' endpoint. Successful exploitation could lead to unauthorized modification of customer data by an unauthenticated attacker. Access to the admin console is required for successful exploitation.

CVSS v3 6.5 MEDIUM
CVSS v2.0 6.4 MEDIUM

6.5^/10

CVSS v3 : MEDIUM

Vector :

Exploitability : 3.9 / Impact : 2.5

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction NONE

Confidentiality Impact LOW

Integrity Impact LOW

Availability Impact NONE

Scope UNCHANGED

6.4^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:P/I:P/A:N

Exploitability : 10.0 / Impact : 4.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
https://helpx.adobe.com/security/products/magento/apsb21-30.html	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:magento:magento:::::commerce:::*
	cpe:2.3:a:magento:magento:::::open_source:::*
	cpe:2.3:a:magento:magento:::::commerce:::*
	cpe:2.3:a:magento:magento:::::open_source:::*

History

02 Aug 2022, 15:59

Type	Values Removed	Values Added
CWE	~~CWE-285~~	NVD-CWE-Other

02 Jul 2021, 15:46

Type	Values Removed	Values Added
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : 6.4 v3 : 6.5
CWE		CWE-285
CPE		cpe:2.3:a:magento:magento:::::open_source:::* cpe:2.3:a:magento:magento:::::commerce:::*
References	~~(MISC) https://helpx.adobe.com/security/products/magento/apsb21-30.html -~~	(MISC) https://helpx.adobe.com/security/products/magento/apsb21-30.html - Vendor Advisory

28 Jun 2021, 14:21

Type	Values Removed	Values Added
New CVE

Information

Published : 2021-06-28 14:15

Updated : 2023-12-10 13:55

NVD link : CVE-2021-28563

Mitre link : CVE-2021-28563

CVE.ORG link : CVE-2021-28563

JSON object : View

Products Affected

magento

magento

CWE

NVD-CWE-Other CWE-285

Improper Authorization

{"id": "CVE-2021-28563", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.4, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 4.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 3.9}, {"type": "Secondary", "source": "psirt@adobe.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 6.5, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "LOW"}, "impactScore": 2.5, "exploitabilityScore": 3.9}]}, "published": "2021-06-28T14:15:10.220", "references": [{"url": "https://helpx.adobe.com/security/products/magento/apsb21-30.html", "tags": ["Vendor Advisory"], "source": "psirt@adobe.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}, {"type": "Secondary", "source": "psirt@adobe.com", "description": [{"lang": "en", "value": "CWE-285"}]}], "descriptions": [{"lang": "en", "value": "Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are affected by an Improper Authorization vulnerability via the 'Create Customer' endpoint. Successful exploitation could lead to unauthorized modification of customer data by an unauthenticated attacker. Access to the admin console is required for successful exploitation."}, {"lang": "es", "value": "Magento versiones 2.4.2 (y anteriores), versiones 2.4.1-p1 (y anteriores) y versiones 2.3.6-p1 (y anteriores), est\u00e1n afectadas por una vulnerabilidad de Autorizaci\u00f3n Inapropiada por medio del endpoint \"Create Customer\". Una explotaci\u00f3n con \u00e9xito podr\u00eda conllevar a una modificaci\u00f3n no autorizada de los datos del cliente por parte de un atacante no autenticado. Es requerido acceso a la consola de administraci\u00f3n para una explotaci\u00f3n con \u00e9xito"}], "lastModified": "2022-08-02T15:59:59.663", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:magento:magento:*:*:*:*:commerce:*:*:*", "vulnerable": true, "matchCriteriaId": "727FB993-9F35-40EA-BF41-E4757F21C5FE", "versionEndExcluding": "2.3.7"}, {"criteria": "cpe:2.3:a:magento:magento:*:*:*:*:open_source:*:*:*", "vulnerable": true, "matchCriteriaId": "9DF037A1-026B-4083-97FB-13578A56326C", "versionEndExcluding": "2.3.7"}, {"criteria": "cpe:2.3:a:magento:magento:*:*:*:*:commerce:*:*:*", "vulnerable": true, "matchCriteriaId": "664A23B2-48D1-46E8-BA7F-3F693C19D5CC", "versionEndIncluding": "2.4.2", "versionStartIncluding": "2.4.0"}, {"criteria": "cpe:2.3:a:magento:magento:*:*:*:*:open_source:*:*:*", "vulnerable": true, "matchCriteriaId": "FC82D539-A1A2-46CB-93BB-652B3D5F2E55", "versionEndIncluding": "2.4.2", "versionStartIncluding": "2.4.0"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@adobe.com"}