CVE-2021-28585: Magento Commerce improper input validation in customer customer webapi
First published: Mon Jun 28 2021(Updated: )
Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are affected by an Improper input validation vulnerability in the New customer WebAPI.Successful exploitation could allow an attacker to send unsolicited spam e-mails.
Credit: psirt@adobe.com psirt@adobe.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| composer/magento/community-edition | <2.3.7 | 2.3.7 |
| composer/magento/community-edition | >=2.4.0<2.4.2-p1 | 2.4.2-p1 |
| Magento Magento | <2.3.6 | |
| Magento Magento | <2.3.6 | |
| Magento Magento | =2.3.6 | |
| Magento Magento | =2.3.6 | |
| Magento Magento | =2.3.6-p1 | |
| Magento Magento | =2.3.6-p1 | |
| Magento Magento | =2.4.1 | |
| Magento Magento | =2.4.1 | |
| Magento Magento | =2.4.1-p1 | |
| Magento Magento | =2.4.1-p1 | |
| Magento Magento | =2.4.2 | |
| Magento Magento | =2.4.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this Magento vulnerability?
The vulnerability ID for this Magento vulnerability is CVE-2021-28585.
What is the severity of CVE-2021-28585?
The severity of CVE-2021-28585 is medium (5.3).
Which versions of Magento are affected by CVE-2021-28585?
Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier), and 2.3.6-p1 (and earlier) are affected by CVE-2021-28585.
What is the impact of CVE-2021-28585?
Successful exploitation of CVE-2021-28585 could allow an attacker to send unsolicited spam e-mails.
Where can I find more information about CVE-2021-28585?
You can find more information about CVE-2021-28585 at the following link: [link](https://helpx.adobe.com/security/products/magento/apsb21-30.html)
- collector/nvd-index
- agent/type
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-c38m-9668-6j2w
- alias/CVE-2021-28585
- agent/software-canonical-lookup
- agent/weakness
- agent/references
- agent/author
- agent/severity
- agent/remedy
- agent/description
- collector/nvd-cve
- source/NVD
- agent/softwarecombine
- collector/github-advisory
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/title
- agent/first-publish-date
- agent/tags
- agent/event
- vendor/magento
- canonical/magento magento
- version/magento magento/2.3.6
- version/magento magento/2.3.6-p1
- version/magento magento/2.4.1
- version/magento magento/2.4.1-p1
- version/magento magento/2.4.2
- package-manager/composer