GitHub Advisoryadvisory · Packagist

GHSA-crjc-2v9m-8w7r Magento improper authorization vulnerability in the integrations module

MEDIUM Published 2022-05-24 Modified 2025-02-10 Official page ↗
Aliases
CVE-2021-21026
Ecosystem
Packagist
Packages
magento/community-edition, magento/project-community-edition
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N
Weaknesses
CWE-285
Reviewed
2024-01-11

Affected packages

• Packagist magento/community-edition: < 2.3.6-p1 → fixed in 2.3.6-p1 • Packagist magento/community-edition: >= 2.4.0, < 2.4.2 → fixed in 2.4.2 • Packagist magento/project-community-edition: <= 2.0.2 (no fix yet)

Description

Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are affected by an improper authorization vulnerability in the integrations module. Successful exploitation could lead to unauthorized access to restricted resources by an unauthenticated attacker. Access to the admin console is required for successful exploitation.

Related

Alias · CVE (1)

  • CVE-2021-21026 Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are affected by an improper authorization… vulnerability

Weakness · CWE (1)

  • CWE-285 Improper Authorization weakness

References