CVE-2021-21012: medium-severity vulnerability in Adobe Magento Commerce
Magento Commerce Insecure Direct Object Reference Vulnerability Could Lead To Sensitive Information Disclosure
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
Magento's checkout module allows attackers to access other customers' sensitive information by manipulating order references. This happens because the system doesn't properly verify who should see which data.
Unauthenticated or authenticated attackers can exploit IDOR in the checkout module by directly referencing object identifiers (order IDs, customer data) without proper authorization checks. Exploitation requires knowledge of valid object identifiers and results in unauthorized access to sensitive checkout-related information including customer details and order data.
In the same product, most dangerous first.