title: Magento Commerce Incorrect permissions Could Lead To Unauthorized Access
description: Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to an insecure direct object reference (IDOR) in the product module. Successful exploitation could lead to unauthorized access to restricted resources.
problem types: Authorization Bypass Through User-Controlled Key (CWE-639)
affected:
{
product: Magento Commerce
vendor: Adobe
versions:
lessThanOrEqual: 2.4.1, status: affected, version: unspecified, versionType: custom
lessThanOrEqual: 2.4.0-p1, status: affected, version: unspecified, versionType: custom
lessThanOrEqual: 2.3.6, status: affected, version: unspecified, versionType: custom
lessThanOrEqual: None, status: affected, version: unspecified, versionType: custom
}
metrics:
cvssV3_0: [
attackComplexity: LOW
attackVector: NETWORK
availabilityImpact: NONE
baseScore: 5.3
baseSeverity: MEDIUM
confidentialityImpact: LOW
integrityImpact: NONE
privilegesRequired: NONE
scope: UNCHANGED
userInteraction: NONE
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
version: 3.0
]