GHSA-rhff-65hp-55rw

ghsaUSosv

Magento allows attackers to alter the price of items

view advisory published 2022-05-24Licence: CC-BY-4.0

Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability during the checkout process. An unauthenticated attacker can leverage this vulnerability to alter the price of items.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2021-36030US	high7.5	2.29% (83rd)	—	2021-09-01
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability during the checkout process…

references

External citations — patches, advisories, analysis.

https://github.com/magento/magento2PACKAGE
https://helpx.adobe.com/security/products/magento/apsb21-64.htmlWEB
https://nvd.nist.gov/vuln/detail/CVE-2021-36030ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan