CVE-2021-36044

mediumpriority · track · 21EPSS 0.020 · 81 %ileEURUUS

grimoire priorityP3 · Track

Exploitable?

—

no known exploitation

Likely / severe?

2.01% (81st) EPSS

CVSS 5 · medium

Is it mine?

20 products

Check your exposure

Who says so?

5 sources

cnnvd · enisa_euvd · fstec_bdu · nvd

EPSS · scored 2026-10-27

Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability. An unauthenticated attacker could abuse this vulnerability to cause a server-side denial-of-service using a GraphQL field.

cvss

Technical severity, 0–10. One row per scoring source.

7.5

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 5–7.5

v2.05mediumAV:N/AC:L/Au:N/C:N/I:N/A:Pprimary · NVD / NIST USexploitability 10 · impact 2.9

v3.17.5highAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · FSTEC (BDU) RU

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · ENISA EU

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · psirt@adobe.comexploitability 3.9 · impact 3.6

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · OSV

v3.16.9mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:Usecondary · CVSS-BT (t0sche)

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-20USCWE-20USCWE-20US

affected products (20)

Products and version ranges known to be affected.

Adobe Magento Commerce≤ unspecified ≤2.4.2enisa_euvdEU
Adobe Magento Commerce≤ unspecified ≤2.3.7enisa_euvdEU
Adobe Magento Commerce≤ unspecified ≤Noneenisa_euvdEU
Adobe Magento Commerce≤ unspecified ≤2.4.2-p1enisa_euvdEU
Adobe Systems Inc. Magento Commerce≤ 2.4.3fstec_bduRU
Adobe Systems Inc. Magento Commerce≤ 2.3.7-p1fstec_bduRU
Adobe Systems Inc. Magento Commerce≤ 2.4.2-p2fstec_bduRU
Adobe Systems Inc. Magento Open Source≤ 2.3.7-p1fstec_bduRU
Adobe Systems Inc. Magento Open Source≤ 2.4.2-p2fstec_bduRU
Adobe Systems Inc. Magento Open Source≤ 2.4.3fstec_bduRU
adobe adobe commerce2.3.0 → 2.3.7nvdUScpe:2.3:a:adobe:adobe_commerce:*:*:*:*:*:*:*:*
adobe adobe commerce2.4.0 → 2.4.2nvdUScpe:2.3:a:adobe:adobe_commerce:*:*:*:*:*:*:*:*
adobe adobe commerce= 2.4.2nvdUScpe:2.3:a:adobe:adobe_commerce:*:*:*:*:*:*:*:*
adobe magento open source2.3.0 → 2.3.7nvdUScpe:2.3:a:adobe:magento_open_source:*:*:*:*:*:*:*:*
adobe magento open source2.4.0 → 2.4.2nvdUScpe:2.3:a:adobe:magento_open_source:*:*:*:*:*:*:*:*
adobe magento open source= 2.4.2nvdUScpe:2.3:a:adobe:magento_open_source:*:*:*:*:*:*:*:*
Packagist magento/community-editionall versionsosvUSpkg:composer/magento/community-edition
Packagist magento/community-edition< 2.3.7-p1osvUSpkg:composer/magento/community-edition
Packagist magento/community-edition2.4.2-p1 → 2.4.2-p2osvUSpkg:composer/magento/community-edition
Packagist magento/project-community-edition≤ 2.0.2osvUSpkg:composer/magento/project-community-edition

advisories (1)

Vendor and ecosystem advisories describing this.

GHSA-wr57-3h2f-3q95Magento affected by a server-side denial-of-service using a GraphQL field2022-05-24ghsa · osvUS
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability. An unauthenticated attacker could abuse this vulnerability to cause a server-side denial-of-service using a GraphQL field.

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu nvd osv NVD CVE.org MITRE

published 2021-09-01modified 2026-06-17

references (6)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan