Ecosyste.ms: Advisories

An open API service providing security vulnerability metadata for many open source software ecosystems.

Security Advisories: GSA_kwCzR0hTQS1jcmpjLTJ2OW0tOHc3cs4AAniu

Magento improper authorization vulnerability in the integrations module

Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are affected by an improper authorization vulnerability in the integrations module. Successful exploitation could lead to unauthorized access to restricted resources by an unauthenticated attacker. Access to the admin console is required for successful exploitation.

Permalink: https://github.com/advisories/GHSA-crjc-2v9m-8w7r
JSON: https://advisories.ecosyste.ms/api/v1/advisories/GSA_kwCzR0hTQS1jcmpjLTJ2OW0tOHc3cs4AAniu
Source: GitHub Advisory Database
Origin: Unspecified
Severity: Moderate
Classification: General
Published: almost 2 years ago
Updated: 4 months ago


CVSS Score: 5.3
CVSS vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N

Identifiers: GHSA-crjc-2v9m-8w7r, CVE-2021-21026
References: Repository: https://github.com/magento/magento2
Blast Radius: 5.7

Affected Packages

packagist:magento/community-edition
Dependent packages: 12
Dependent repositories: 12
Downloads: 47,718 total
Affected Version Ranges: >= 2.4.0, < 2.4.2, < 2.3.6-p1
Fixed in: 2.4.2, 2.3.6-p1
All affected versions: 2.0.0, 2.0.1, 2.0.2, 2.0.3, 2.0.4, 2.0.5, 2.0.6, 2.0.7, 2.0.8, 2.0.9, 2.0.10, 2.0.11, 2.0.12, 2.0.13, 2.0.14, 2.0.15, 2.0.16, 2.0.17, 2.0.18, 2.1.0, 2.1.1, 2.1.2, 2.1.3, 2.1.4, 2.1.5, 2.1.6, 2.1.7, 2.1.8, 2.1.9, 2.1.10, 2.1.11, 2.1.12, 2.1.13, 2.1.14, 2.1.15, 2.1.16, 2.1.17, 2.1.18, 2.2.0, 2.2.1, 2.2.2, 2.2.3, 2.2.4, 2.2.5, 2.2.6, 2.2.7, 2.2.8, 2.2.9, 2.2.10, 2.2.11, 2.3.0, 2.3.1, 2.3.2, 2.3.3, 2.3.4, 2.3.5, 2.4.0, 2.4.1
All unaffected versions: 2.3.6, 2.3.7, 2.4.2, 2.4.3, 2.4.4, 2.4.5, 2.4.6, 2.4.7