GitHub Advisoryadvisory · Packagist

GHSA-rhff-65hp-55rw Magento allows attackers to alter the price of items

HIGH Published 2022-05-24 Modified 2025-11-06 Official page ↗
Aliases
CVE-2021-36030
Ecosystem
Packagist
Packages
magento/project-community-edition, magento/community-edition
Severity
High
Weaknesses
CWE-20
Reviewed
2025-11-06

Affected packages

• Packagist magento/project-community-edition: <= 2.0.2 (no fix yet) • Packagist magento/community-edition: < 2.3.7-p1 → fixed in 2.3.7-p1 • Packagist magento/community-edition: 2.3.7 (no fix yet) • Packagist magento/community-edition: >= 2.4.2-p1, < 2.4.2-p2 → fixed in 2.4.2-p2 • Packagist magento/community-edition: 2.4.2 (no fix yet)

Description

Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability during the checkout process. An unauthenticated attacker can leverage this vulnerability to alter the price of items.

Related

Alias · CVE (1)

  • CVE-2021-36030 Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation… vulnerability

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References