Skip to main content

Improper Authorization

CVE-2021-36029

High
9.1/10

Summary

Magento Commerce in versions prior to 2.3.7-p1, 2.4.2 prior to 2.4.2-p2 and magento/project-community-edition versions through 2.0.2 are affected by an improper authorization vulnerability. An attacker with admin privileges could leverage this vulnerability to achieve remote code execution.

  • LOW
  • NETWORK
  • HIGH
  • CHANGED
  • NONE
  • HIGH
  • HIGH
  • HIGH

CWE-285 - Improper Authorization

The software does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action.

References

Advisory Timeline

  • Published