CVE-2021-21022: medium-severity vulnerability in Adobe Magento Commerce
Magento Commerce Incorrect permissions Could Lead To Unauthorized Access
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
No sign of exploitation. No public exploitation artifact known so far.
Magento Commerce has a flaw that allows attackers to access products and information they shouldn't be able to see by manipulating direct object references. This could expose sensitive product data or allow unauthorized users to view restricted resources.
An insecure direct object reference (IDOR) vulnerability exists in Magento's product module where insufficient permission checks allow authenticated or unauthenticated attackers to access restricted resources by directly referencing objects. Exploitation requires manipulating product identifiers or API parameters; successful exploitation leads to unauthorized information disclosure of sensitive product data.
In the same product, most dangerous first.