CVE-2021-21012CWE-639

Magento Commerce Insecure Direct Object Reference Vulnerability Could Lead To Sensitive Information Disclosure

Medium · published January 13, 2021

CVSS v3.0
5.3
EPSS
4%
Percentile
90.5
In the wild
Unconfirmed
What it is

Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to an insecure direct object vulnerability (IDOR) in the checkout module. Successful exploitation could lead to sensitive information disclosure.

The record
Technical detail
CVSS v3.0
5.3 · MEDIUM
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.03999 · 90.5th percentile
Weakness
CWE-639 · Authorization Bypass Through User-Controlled Key
Published
2021-01-13T22:35Z
EPSS history
Timeline
  • 13 JAN 22:35Z
    Magento Commerce Insecure Direct Object Reference Vulnerability Could Lead To Sensitive Information Disclosure
    cvelistv5