GHSA-2j6v-829g-885q

ghsaUSosv

Magento Improper Access Control

view advisory published 2022-05-24Licence: CC-BY-4.0

Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to an access control bypass vulnerability in the Login as Customer module. Successful exploitation could lead to unauthorized access to restricted resources.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2021-21020US	medium4.3	2.41% (84th)	—	2021-02-11
Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to an access control bypass vulnerability in the Login as Customer module. Succe…

references

External citations — patches, advisories, analysis.

https://github.com/magento/magento2PACKAGE
https://helpx.adobe.com/security/products/magento/apsb21-08.htmlWEB
https://nvd.nist.gov/vuln/detail/CVE-2021-21020ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan