deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-wgpr-9675-8r67
Package: magento/project-community-edition (COMPOSER)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: <= 2.0.2
Patched in: unpatched

Summary: Magento discloses sensitive information via the Multishipping Module

Details:
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability in the Multishipping Module. An authenticated attacker could leverage this vulnerability to achieve sensitive information disclosure.
GitHub Security Advisory: GHSA-j46h-qjjv-cxfj
Package: magento/community-edition (COMPOSER)
Severity: HIGH (CVSS 7.2)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: < 2.3.7-p1
Patched in: 2.3.7-p1

Summary: Magento affected by remote code execution via a file upload

Details:
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability. An attacker with admin privileges can upload a specially crafted file to achieve remote code execution.
GitHub Security Advisory: GHSA-j46h-qjjv-cxfj
Package: magento/community-edition (COMPOSER)
Severity: HIGH (CVSS 7.2)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: = 2.3.7
Patched in: unpatched

Summary: Magento affected by remote code execution via a file upload

Details:
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability. An attacker with admin privileges can upload a specially crafted file to achieve remote code execution.
GitHub Security Advisory: GHSA-j46h-qjjv-cxfj
Package: magento/community-edition (COMPOSER)
Severity: HIGH (CVSS 7.2)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: >= 2.4.2-p1, < 2.4.2-p2
Patched in: 2.4.2-p2

Summary: Magento affected by remote code execution via a file upload

Details:
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability. An attacker with admin privileges can upload a specially crafted file to achieve remote code execution.
GitHub Security Advisory: GHSA-j46h-qjjv-cxfj
Package: magento/community-edition (COMPOSER)
Severity: HIGH (CVSS 7.2)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: = 2.4.2
Patched in: unpatched

Summary: Magento affected by remote code execution via a file upload

Details:
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability. An attacker with admin privileges can upload a specially crafted file to achieve remote code execution.
GitHub Security Advisory: GHSA-j46h-qjjv-cxfj
Package: magento/project-community-edition (COMPOSER)
Severity: HIGH (CVSS 7.2)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: <= 2.0.2
Patched in: unpatched

Summary: Magento affected by remote code execution via a file upload

Details:
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability. An attacker with admin privileges can upload a specially crafted file to achieve remote code execution.
GitHub Security Advisory: GHSA-vrq2-w7r7-3fp2
Package: magento/community-edition (COMPOSER)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-285: Improper Authorization, CWE-863: Incorrect Authorization
Vulnerable versions: < 2.3.7-p1
Patched in: 2.3.7-p1

Summary: Magento is affected by an improper authorization vulnerability

Details:
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper authorization vulnerability. An authenticated attacker could leverage this vulnerability to achieve sensitive information disclosure.
GitHub Security Advisory: GHSA-vrq2-w7r7-3fp2
Package: magento/community-edition (COMPOSER)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-285: Improper Authorization, CWE-863: Incorrect Authorization
Vulnerable versions: = 2.3.7
Patched in: unpatched

Summary: Magento is affected by an improper authorization vulnerability

Details:
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper authorization vulnerability. An authenticated attacker could leverage this vulnerability to achieve sensitive information disclosure.
GitHub Security Advisory: GHSA-vrq2-w7r7-3fp2
Package: magento/community-edition (COMPOSER)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-285: Improper Authorization, CWE-863: Incorrect Authorization
Vulnerable versions: >= 2.4.2-p1, < 2.4.2-p2
Patched in: 2.4.2-p2

Summary: Magento is affected by an improper authorization vulnerability

Details:
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper authorization vulnerability. An authenticated attacker could leverage this vulnerability to achieve sensitive information disclosure.
GitHub Security Advisory: GHSA-vrq2-w7r7-3fp2
Package: magento/community-edition (COMPOSER)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-285: Improper Authorization, CWE-863: Incorrect Authorization
Vulnerable versions: = 2.4.2
Patched in: unpatched

Summary: Magento is affected by an improper authorization vulnerability

Details:
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper authorization vulnerability. An authenticated attacker could leverage this vulnerability to achieve sensitive information disclosure.
GitHub Security Advisory: GHSA-vrq2-w7r7-3fp2
Package: magento/project-community-edition (COMPOSER)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-285: Improper Authorization, CWE-863: Incorrect Authorization
Vulnerable versions: <= 2.0.2
Patched in: unpatched

Summary: Magento is affected by an improper authorization vulnerability

Details:
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper authorization vulnerability. An authenticated attacker could leverage this vulnerability to achieve sensitive information disclosure.
GitHub Security Advisory: GHSA-3g7m-g8qm-x6j5
Package: magento/community-edition (COMPOSER)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: = 2.4.2
Patched in: unpatched

Summary: Magento discloses sensitive information

Details:
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability via the `quoteId` parameter. An attacker can abuse this vulnerability to disclose sensitive information.
GitHub Security Advisory: GHSA-3g7m-g8qm-x6j5
Package: magento/community-edition (COMPOSER)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: >= 2.4.2-p1, < 2.4.2-p2
Patched in: 2.4.2-p2

Summary: Magento discloses sensitive information

Details:
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability via the `quoteId` parameter. An attacker can abuse this vulnerability to disclose sensitive information.
GitHub Security Advisory: GHSA-3g7m-g8qm-x6j5
Package: magento/community-edition (COMPOSER)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: = 2.3.7
Patched in: unpatched

Summary: Magento discloses sensitive information

Details:
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability via the `quoteId` parameter. An attacker can abuse this vulnerability to disclose sensitive information.
GitHub Security Advisory: GHSA-3g7m-g8qm-x6j5
Package: magento/community-edition (COMPOSER)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: < 2.3.7-p1
Patched in: 2.3.7-p1

Summary: Magento discloses sensitive information

Details:
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability via the `quoteId` parameter. An attacker can abuse this vulnerability to disclose sensitive information.
GitHub Security Advisory: GHSA-3g7m-g8qm-x6j5
Package: magento/project-community-edition (COMPOSER)
Severity: MODERATE (CVSS 6.5)
CWE: CWE-863: Incorrect Authorization
Vulnerable versions: <= 2.0.2
Patched in: unpatched

Summary: Magento discloses sensitive information

Details:
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability via the `quoteId` parameter. An attacker can abuse this vulnerability to disclose sensitive information.
GitHub Security Advisory: GHSA-qmq6-jpvg-j547
Package: magento/community-edition (COMPOSER)
Severity: HIGH (CVSS 7.2)
CWE: CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection'), CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Vulnerable versions: = 2.4.2
Patched in: unpatched

Summary: Magento is affected by an os command injection via the Data collection endpoint

Details:
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an Improper Neutralization of Special Elements Used In A Command via the Data collection endpoint. An attacker with admin privileges can upload a specially crafted file to achieve remote code execution.
GitHub Security Advisory: GHSA-qmq6-jpvg-j547
Package: magento/community-edition (COMPOSER)
Severity: HIGH (CVSS 7.2)
CWE: CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection'), CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Vulnerable versions: >= 2.4.2-p1, < 2.4.2-p2
Patched in: 2.4.2-p2

Summary: Magento is affected by an os command injection via the Data collection endpoint

Details:
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an Improper Neutralization of Special Elements Used In A Command via the Data collection endpoint. An attacker with admin privileges can upload a specially crafted file to achieve remote code execution.
GitHub Security Advisory: GHSA-qmq6-jpvg-j547
Package: magento/community-edition (COMPOSER)
Severity: HIGH (CVSS 7.2)
CWE: CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection'), CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Vulnerable versions: = 2.3.7
Patched in: unpatched

Summary: Magento is affected by an os command injection via the Data collection endpoint

Details:
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an Improper Neutralization of Special Elements Used In A Command via the Data collection endpoint. An attacker with admin privileges can upload a specially crafted file to achieve remote code execution.
GitHub Security Advisory: GHSA-qmq6-jpvg-j547
Package: magento/community-edition (COMPOSER)
Severity: HIGH (CVSS 7.2)
CWE: CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection'), CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Vulnerable versions: < 2.3.7-p1
Patched in: 2.3.7-p1

Summary: Magento is affected by an os command injection via the Data collection endpoint

Details:
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an Improper Neutralization of Special Elements Used In A Command via the Data collection endpoint. An attacker with admin privileges can upload a specially crafted file to achieve remote code execution.
GitHub Security Advisory: GHSA-qmq6-jpvg-j547
Package: magento/project-community-edition (COMPOSER)
Severity: HIGH (CVSS 7.2)
CWE: CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection'), CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
Vulnerable versions: <= 2.0.2
Patched in: unpatched

Summary: Magento is affected by an os command injection via the Data collection endpoint

Details:
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an Improper Neutralization of Special Elements Used In A Command via the Data collection endpoint. An attacker with admin privileges can upload a specially crafted file to achieve remote code execution.
GitHub Security Advisory: GHSA-gvfx-9m9v-h839
Package: magento/community-edition (COMPOSER)
Severity: CRITICAL (CVSS 9.1)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: = 2.4.2
Patched in: unpatched

Summary: Magento is affected by an improper input validation vulnerability while saving a customer's details

Details:
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability while saving a customer's details with a specially crafted file. An authenticated attacker with admin privileges can leverage this vulnerability to achieve remote code execution.
GitHub Security Advisory: GHSA-gvfx-9m9v-h839
Package: magento/community-edition (COMPOSER)
Severity: CRITICAL (CVSS 9.1)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: >= 2.4.2-p1, < 2.4.2-p2
Patched in: 2.4.2-p2

Summary: Magento is affected by an improper input validation vulnerability while saving a customer's details

Details:
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability while saving a customer's details with a specially crafted file. An authenticated attacker with admin privileges can leverage this vulnerability to achieve remote code execution.
GitHub Security Advisory: GHSA-gvfx-9m9v-h839
Package: magento/community-edition (COMPOSER)
Severity: CRITICAL (CVSS 9.1)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: = 2.3.7
Patched in: unpatched

Summary: Magento is affected by an improper input validation vulnerability while saving a customer's details

Details:
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability while saving a customer's details with a specially crafted file. An authenticated attacker with admin privileges can leverage this vulnerability to achieve remote code execution.
GitHub Security Advisory: GHSA-gvfx-9m9v-h839
Package: magento/community-edition (COMPOSER)
Severity: CRITICAL (CVSS 9.1)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: < 2.3.7-p1
Patched in: 2.3.7-p1

Summary: Magento is affected by an improper input validation vulnerability while saving a customer's details

Details:
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability while saving a customer's details with a specially crafted file. An authenticated attacker with admin privileges can leverage this vulnerability to achieve remote code execution.
GitHub Security Advisory: GHSA-gvfx-9m9v-h839
Package: magento/project-community-edition (COMPOSER)
Severity: CRITICAL (CVSS 9.1)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: <= 2.0.2
Patched in: unpatched

Summary: Magento is affected by an improper input validation vulnerability while saving a customer's details

Details:
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability while saving a customer's details with a specially crafted file. An authenticated attacker with admin privileges can leverage this vulnerability to achieve remote code execution.
GitHub Security Advisory: GHSA-5vw8-r55w-f4q4
Package: magento/community-edition (COMPOSER)
Severity: HIGH (CVSS 8.8)
CWE: CWE-20: Improper Input Validation, CWE-639: Authorization Bypass Through User-Controlled Key
Vulnerable versions: = 2.4.2
Patched in: unpatched

Summary: Magento is affected by an improper input validation vulnerability

Details:
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability. An authenticated attacker can trigger an insecure direct object reference in the `V1/customers/me` endpoint to achieve information exposure and privilege escalation.
GitHub Security Advisory: GHSA-5vw8-r55w-f4q4
Package: magento/community-edition (COMPOSER)
Severity: HIGH (CVSS 8.8)
CWE: CWE-20: Improper Input Validation, CWE-639: Authorization Bypass Through User-Controlled Key
Vulnerable versions: >= 2.4.2-p1, < 2.4.2-p2
Patched in: 2.4.2-p2

Summary: Magento is affected by an improper input validation vulnerability

Details:
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability. An authenticated attacker can trigger an insecure direct object reference in the `V1/customers/me` endpoint to achieve information exposure and privilege escalation.
GitHub Security Advisory: GHSA-5vw8-r55w-f4q4
Package: magento/community-edition (COMPOSER)
Severity: HIGH (CVSS 8.8)
CWE: CWE-20: Improper Input Validation, CWE-639: Authorization Bypass Through User-Controlled Key
Vulnerable versions: = 2.3.7
Patched in: unpatched

Summary: Magento is affected by an improper input validation vulnerability

Details:
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability. An authenticated attacker can trigger an insecure direct object reference in the `V1/customers/me` endpoint to achieve information exposure and privilege escalation.
GitHub Security Advisory: GHSA-5vw8-r55w-f4q4
Package: magento/community-edition (COMPOSER)
Severity: HIGH (CVSS 8.8)
CWE: CWE-20: Improper Input Validation, CWE-639: Authorization Bypass Through User-Controlled Key
Vulnerable versions: < 2.3.7-p1
Patched in: 2.3.7-p1

Summary: Magento is affected by an improper input validation vulnerability

Details:
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability. An authenticated attacker can trigger an insecure direct object reference in the `V1/customers/me` endpoint to achieve information exposure and privilege escalation.
GitHub Security Advisory: GHSA-5vw8-r55w-f4q4
Package: magento/project-community-edition (COMPOSER)
Severity: HIGH (CVSS 8.8)
CWE: CWE-20: Improper Input Validation, CWE-639: Authorization Bypass Through User-Controlled Key
Vulnerable versions: <= 2.0.2
Patched in: unpatched

Summary: Magento is affected by an improper input validation vulnerability

Details:
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability. An authenticated attacker can trigger an insecure direct object reference in the `V1/customers/me` endpoint to achieve information exposure and privilege escalation.
GitHub Security Advisory: GHSA-5pjj-7fq8-9gpf
Package: magento/community-edition (COMPOSER)
Severity: CRITICAL (CVSS 0.0)
CWE: CWE-91: XML Injection (aka Blind XPath Injection)
Vulnerable versions: = 2.4.2
Patched in: unpatched

Summary: Magento has an XML Injection vulnerability

Details:
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability when saving a configurable product. An attacker with admin privileges can trigger a specially crafted script to achieve remote code execution.
GitHub Security Advisory: GHSA-5pjj-7fq8-9gpf
Package: magento/community-edition (COMPOSER)
Severity: CRITICAL (CVSS 0.0)
CWE: CWE-91: XML Injection (aka Blind XPath Injection)
Vulnerable versions: >= 2.4.2-p1, < 2.4.2-p2
Patched in: 2.4.2-p2

Summary: Magento has an XML Injection vulnerability

Details:
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability when saving a configurable product. An attacker with admin privileges can trigger a specially crafted script to achieve remote code execution.
GitHub Security Advisory: GHSA-5pjj-7fq8-9gpf
Package: magento/community-edition (COMPOSER)
Severity: CRITICAL (CVSS 0.0)
CWE: CWE-91: XML Injection (aka Blind XPath Injection)
Vulnerable versions: = 2.3.7
Patched in: unpatched

Summary: Magento has an XML Injection vulnerability

Details:
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability when saving a configurable product. An attacker with admin privileges can trigger a specially crafted script to achieve remote code execution.
GitHub Security Advisory: GHSA-5pjj-7fq8-9gpf
Package: magento/community-edition (COMPOSER)
Severity: CRITICAL (CVSS 0.0)
CWE: CWE-91: XML Injection (aka Blind XPath Injection)
Vulnerable versions: < 2.3.7-p1
Patched in: 2.3.7-p1

Summary: Magento has an XML Injection vulnerability

Details:
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability when saving a configurable product. An attacker with admin privileges can trigger a specially crafted script to achieve remote code execution.
GitHub Security Advisory: GHSA-5pjj-7fq8-9gpf
Package: magento/project-community-edition (COMPOSER)
Severity: CRITICAL (CVSS 0.0)
CWE: CWE-91: XML Injection (aka Blind XPath Injection)
Vulnerable versions: <= 2.0.2
Patched in: unpatched

Summary: Magento has an XML Injection vulnerability

Details:
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability when saving a configurable product. An attacker with admin privileges can trigger a specially crafted script to achieve remote code execution.
GitHub Security Advisory: GHSA-rhff-65hp-55rw
Package: magento/community-edition (COMPOSER)
Severity: HIGH (CVSS 0.0)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: = 2.4.2
Patched in: unpatched

Summary: Magento allows attackers to alter the price of items

Details:
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability during the checkout process. An unauthenticated attacker can leverage this vulnerability to alter the price of items.
GitHub Security Advisory: GHSA-rhff-65hp-55rw
Package: magento/community-edition (COMPOSER)
Severity: HIGH (CVSS 0.0)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: >= 2.4.2-p1, < 2.4.2-p2
Patched in: 2.4.2-p2

Summary: Magento allows attackers to alter the price of items

Details:
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability during the checkout process. An unauthenticated attacker can leverage this vulnerability to alter the price of items.
GitHub Security Advisory: GHSA-rhff-65hp-55rw
Package: magento/community-edition (COMPOSER)
Severity: HIGH (CVSS 0.0)
CWE: CWE-20: Improper Input Validation
Vulnerable versions: = 2.3.7
Patched in: unpatched

Summary: Magento allows attackers to alter the price of items

Details:
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability during the checkout process. An unauthenticated attacker can leverage this vulnerability to alter the price of items.