CVE-2021-36039: Magento Commerce `quoteId` parameter Incorrect Authorization Vulnerability Could Lead To Information Disclosure
First published: Tue Aug 10 2021(Updated: )
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability via the `quoteId` parameter. An attacker can abuse this vulnerability to disclose sensitive information.
Credit: psirt@adobe.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Adobe Adobe Commerce | >=2.3.0<=2.3.7 | |
| Adobe Adobe Commerce | >=2.4.0<=2.4.2 | |
| Adobe Adobe Commerce | =2.4.2-p1 | |
| Adobe Magento Open Source | >=2.3.0<=2.3.7 | |
| Adobe Magento Open Source | >=2.4.0<=2.4.2 | |
| Adobe Magento Open Source | =2.4.2-p1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the vulnerability ID for this Magento Commerce vulnerability?
The vulnerability ID for this Magento Commerce vulnerability is CVE-2021-36039.
Which versions of Magento Commerce are affected by this vulnerability?
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier), and 2.3.7 (and earlier) are affected by this vulnerability.
What is the severity of CVE-2021-36039?
The severity of CVE-2021-36039 is medium with a CVSS score of 6.5.
How can an attacker exploit this vulnerability?
An attacker can exploit this vulnerability by abusing the `quoteId` parameter to disclose sensitive information.
Where can I find more information about CVE-2021-36039?
You can find more information about CVE-2021-36039 at the following link: [CVE-2021-36039](https://helpx.adobe.com/security/products/magento/apsb21-64.html).
- collector/nvd-index
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/last-modified-date
- agent/remedy
- agent/weakness
- agent/references
- agent/severity
- agent/title
- agent/tags
- agent/first-publish-date
- agent/description
- agent/event
- vendor/adobe
- canonical/adobe adobe commerce
- version/adobe adobe commerce/2.3.0
- version/adobe adobe commerce/2.3.7
- version/adobe adobe commerce/2.4.0
- version/adobe adobe commerce/2.4.2
- version/adobe adobe commerce/2.4.2-p1
- canonical/adobe magento open source
- version/adobe magento open source/2.3.0
- version/adobe magento open source/2.3.7
- version/adobe magento open source/2.4.0
- version/adobe magento open source/2.4.2
- version/adobe magento open source/2.4.2-p1