CVE-2021-28563CWE-285

Magento Commerce improper Authorization via the 'Create Customer' endpoint

Medium · published June 28, 2021

CVSS v3.1
6.5
EPSS
1%
Percentile
72.8
In the wild
Unconfirmed
What it is

Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are affected by an Improper Authorization vulnerability via the 'Create Customer' endpoint. Successful exploitation could lead to unauthorized modification of customer data by an unauthenticated attacker. Access to the admin console is required for successful exploitation.

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.01429 · 72.8th percentile
Weakness
CWE-285 · Improper Authorization
Published
2021-06-28T13:45Z
EPSS history
Timeline
  • 28 JUN 13:45Z
    Magento Commerce improper Authorization via the 'Create Customer' endpoint
    cvelistv5