What is the vulnerability ID for this Magento security vulnerability?

The vulnerability ID for this Magento security vulnerability is CVE-2021-28567.

What is the severity of CVE-2021-28567?

CVE-2021-28567 has a severity rating of 6.5, classified as medium.

What is the impact of CVE-2021-28567?

Successful exploitation of CVE-2021-28567 could allow a low-privileged user to modify customer data in Magento.

Is access to the admin console required for exploiting CVE-2021-28567?

Yes, access to the admin console is required for exploiting CVE-2021-28567.

Vulnerability/
CVE-2021-28567

medium

6.5

CWE

863 285

8/9/2021

24/5/2022

17/9/2024

CVE-2021-28567: Magento Commerce improper authorization allows an authenticated user to perform certain functions without permission

First published: Wed Sep 08 2021(Updated: )

Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are vulnerable to an Improper Authorization vulnerability in the customers module. Successful exploitation could allow a low-privileged user to modify customer data. Access to the admin console is required for successful exploitation.

Credit: psirt@adobe.com psirt@adobe.com

Affected Software	Affected Version	How to fix
composer/magento/community-edition	<2.3.7	2.3.7
composer/magento/community-edition	>=2.4.0<2.4.2-p1	2.4.2-p1
Magento Magento	<=2.4.2
Magento Magento	<=2.4.2

Never miss a vulnerability like this again

Reference Links

Frequently Asked Questions

What is the vulnerability ID for this Magento security vulnerability?
The vulnerability ID for this Magento security vulnerability is CVE-2021-28567.
What is the severity of CVE-2021-28567?
CVE-2021-28567 has a severity rating of 6.5, classified as medium.
What versions of Magento are affected by CVE-2021-28567?
Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier), and 2.3.6-p1 (and earlier) are affected by CVE-2021-28567.
What is the impact of CVE-2021-28567?
Successful exploitation of CVE-2021-28567 could allow a low-privileged user to modify customer data in Magento.
Is access to the admin console required for exploiting CVE-2021-28567?
Yes, access to the admin console is required for exploiting CVE-2021-28567.

collector/nvd-index
agent/weakness
agent/type
agent/references
collector/github-advisory-latest
source/GitHub
alias/GHSA-cc3w-r3w8-hfh7
alias/CVE-2021-28567
agent/software-canonical-lookup
agent/author
agent/description
collector/nvd-cve
source/NVD
agent/softwarecombine
collector/github-advisory
collector/mitre-cve
source/MITRE
agent/severity
agent/last-modified-date
agent/title
agent/first-publish-date
agent/tags
agent/event
vendor/magento
canonical/magento magento
version/magento magento/2.4.2
package-manager/composer

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co

By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.