GitHub Advisoryadvisory · Packagist

GHSA-8pfq-g48p-x7w8 Magento Insecure Direct Object Reference (IDOR) in the product module

MEDIUM Published 2022-05-24 Modified 2025-02-10 Official page ↗
Aliases
CVE-2021-21022
Ecosystem
Packagist
Packages
magento/community-edition, magento/project-community-edition
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Weaknesses
CWE-285, CWE-639
Reviewed
2024-01-10

Affected packages

• Packagist magento/community-edition: < 2.3.6-p1 → fixed in 2.3.6-p1 • Packagist magento/community-edition: >= 2.4.0, < 2.4.1-p1 → fixed in 2.4.1-p1 • Packagist magento/project-community-edition: <= 2.0.2 (no fix yet)

Description

Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to an insecure direct object reference (IDOR) in the product module. Successful exploitation could lead to unauthorized access to restricted resources.

Related

Alias · CVE (1)

  • CVE-2021-21022 Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to an insecure direct object reference… vulnerability

Weakness · CWE (2)

  • CWE-285 Improper Authorization weakness
  • CWE-639 Authorization Bypass Through User-Controlled Key weakness

References