CVE-2021-21026
Assigner: adobe
Published: 2021-02-09T00:00:00
State: PUBLISHED
affected: product: Magento Commerce
vendor: Adobe
versions: lessThanOrEqual: 2.4.1
status: affected
version: unspecified
versionType: custom
lessThanOrEqual: 2.4.0-p1
status: affected
version: unspecified
versionType: custom
lessThanOrEqual: 2.3.6
status: affected
version: unspecified
versionType: custom
lessThanOrEqual: None
status: affected
version: unspecified
versionType: custom
datePublic: 2021-02-09T00:00:00
descriptions: value: Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are affected by an improper authorization vulnerability in the integrations module. Successful exploitation could lead to unauthorized access to restricted resources by an unauthenticated attacker. Access to the admin console is required for successful exploitation.
metrics: cvssV3_0: attackComplexity: HIGH
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
version: 3.0
problemTypes: descriptions: cweId: CWE-285
description: Improper Authorization (CWE-285)
type: CWE
source: discovery: EXTERNAL
title: Magento Commerce Incorrect permissions Could Lead To Unauthorized Access