Description

Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are vulnerable to an Improper Authorization vulnerability in the customers module. Successful exploitation could allow a low-privileged user to modify customer data. Access to the admin console is required for successful exploitation.

Remediation

References

CVE-2021-28567

Related Vulnerabilities

WordPress Plugin Appointment Booking Calendar-BirchPress Scheduler Unspecified Vulnerability (1.13.0)

WordPress Plugin Leaflet Maps Marker Pro Multiple Vulnerabilities (1.5.7)

Drupal Unrestricted Upload of File with Dangerous Type Vulnerability (CVE-2017-6931)

XWiki Missing Authorization Vulnerability (CVE-2022-41937)

WordPress Plugin Registration Forms-User Registration Forms, Invitation-Based Registrations, Front-end User Profile, Login Form & Content Restriction Security Bypass (3.8.1.2)

Severity

Medium

Classification

CVE-2021-28567 CWE-863 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N

Tags

Missing Update Known Vulnerabilities