CVE-2021-28583CWE-657

Magento Commerce insecure storage of sensitive documentation

High · published June 28, 2021

CVSS v3.1
7.5
EPSS
2%
Percentile
79.5
In the wild
Unconfirmed
What it is

Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are affected by a Violation of Secure Design Principles vulnerability in RMA PDF filename formats. Successful exploitation could allow an attacker to get unauthorized access to restricted resources.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS v4.0
Not supplied
EPSS
0.01897 · 79.5th percentile
Weakness
CWE-657 · Violation of Secure Design Principles
Published
2021-06-28T13:47Z
EPSS history
Timeline
  • 28 JUN 13:47Z
    Magento Commerce insecure storage of sensitive documentation
    cvelistv5