CVE-2021-36038
Assigner: adobe
Published: 2021-08-10T00:00:00
State: PUBLISHED
affected: product: Magento Commerce
vendor: Adobe
versions: lessThanOrEqual: 2.4.2
status: affected
version: unspecified
versionType: custom
lessThanOrEqual: 2.4.2-p1
status: affected
version: unspecified
versionType: custom
lessThanOrEqual: 2.3.7
status: affected
version: unspecified
versionType: custom
lessThanOrEqual: None
status: affected
version: unspecified
versionType: custom
datePublic: 2021-08-10T00:00:00
descriptions: value: Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability in the Multishipping Module. An authenticated attacker could leverage this vulnerability to achieve sensitive information disclosure.
metrics: cvssV3_1: attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 6.5
baseSeverity: MEDIUM
confidentialityImpact: HIGH
integrityImpact: NONE
privilegesRequired: LOW
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
version: 3.1
problemTypes: descriptions: cweId: CWE-20
description: Improper Input Validation (CWE-20)
type: CWE
source: discovery: EXTERNAL
title: Magento Commerce Multishipping Module Improper Input Validation Could Lead To Information Exposure