CVE-2021-21022— Magento Commerce Incorrect permissions Could Lead To Unauthorized Access
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2021-21022
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Magento Commerce Incorrect permissions Could Lead To Unauthorized Access
Source: NVD (National Vulnerability Database)
Vulnerability Description
Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to an insecure direct object reference (IDOR) in the product module. Successful exploitation could lead to unauthorized access to restricted resources.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
通过用户控制密钥绕过授权机制
Source: NVD (National Vulnerability Database)
Vulnerability Title
Adobe Magento 授权问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Magento Open Source是提供基本的电子商务功能，允许您从头开始构建独特的在线商店。Magento Commerce是提供一流的购物体验，而无需开发人员的支持。 Adobe Magento Commerce 和 Magento Open Source editions 中存在授权问题漏洞，该漏洞源于网络系统或产品中缺少身份验证措施或身份验证强度不足。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Adobe | Magento Commerce | unspecified ~ 2.4.1 | - |
II. Public POCs for CVE-2021-21022
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2021-21022
请登录查看更多情报信息。
- https://helpx.adobe.com/security/products/magento/apsb21-08.htmlx_refsource_MISC
- https://nvd.nist.gov/vuln/detail/CVE-2021-21022
Same Patch Batch · Adobe · 2021-02-11 · 48 CVEs total
| CVE-2021-21017 | 8.8 HIGH | Acrobat Reader DC Heap-based Buffer Overflow Vulnerability Could Lead To Arbitrary Code Ex |
| CVE-2021-21045 | 8.2 HIGH | Acrobat Reader DC Improper Installer Access Control Vulnerability Could Lead To Privilege |
| CVE-2021-21040 | 7.8 HIGH | Acrobat Reader DC Use-After-Free Vulnerability Could Lead To Arbitrary Code Execution |
| CVE-2021-21038 | 7.8 HIGH | Acrobat Reader DC Out-Of-Bounds Write Vulnerability Could Lead To Arbitrary Code Execution |
| CVE-2021-21037 | 7.8 HIGH | Acrobat Reader DC Path Traversal Vulnerability Could Lead To Arbitrary Code Execution |
| CVE-2021-21036 | 7.8 HIGH | Acrobat Reader DC Integer Overflow Vulnerability Could Lead To Arbitrary Code Execution |
| CVE-2021-21039 | 7.8 HIGH | Acrobat Reader DC Use-After-Free Vulnerability Could Lead To Arbitrary Code Execution |
| CVE-2021-21041 | 7.8 HIGH | Acrobat Reader DC Use-After-Free Vulnerability Could Lead To Arbitrary Code Execution |
| CVE-2021-21057 | 6.6 MEDIUM | Acrobat Reader DC Invalid Memory Read Due To An Uninitialized Pointer |
| CVE-2021-21055 | 6.2 MEDIUM | Adobe Dreamweaver Untrusted Search Path Vulnerability Could Lead To Information Disclosure |
| CVE-2021-21029 | 4.8 MEDIUM | Magento Commerce Reflected Cross-site Scripting Vulnerability Could Lead To Arbitrary Java |
| CVE-2021-21060 | 4.6 MEDIUM | Acrobat Pro DC Improper File Parsing Could Lead to Information Disclosure |
| CVE-2021-21053 | Adobe Illustrator Out-Of-Bounds Write Vulnerability Could Lead To Remote Code Execution | |
| CVE-2021-21062 | Acrobat Reader DC Buffer Overflow Vulnerability Could Lead To Arbitrary Code Execution | |
| CVE-2021-21048 | Adobe Photoshop Buffer Overflow Vulnerability Could Lead To Remote Code Execution Vulnerab | |
| CVE-2021-21052 | Adobe Animate Out-of-Bounds Write Vulnerability Could Lead To Arbitrary Code Execution | |
| CVE-2021-21049 | Adobe Photoshop Out-Of-Bounds Read Vulnerability Could Lead To Remote Code Execution Vulne | |
| CVE-2021-21054 | Adobe Illustrator Out-Of-Bounds Write Vulnerability Could Lead To Remote Code Execution Vu | |
| CVE-2021-21058 | Acrobat Reader DC Memory Corruption Vulnerability Could Lead to Arbitrary Code Execution | |
| CVE-2021-21034 | Acrobat Reader DC Out-Of-Bounds Read Information Disclosure Vulnerability |
Showing top 20 of 48 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Magento Commerce
- CVE-2023-38208
Validate Your Inputs | Improper Neutralization of Special El - CVE-2023-38209
Adobe Commerce Incorrect Authorization Security feature bypa - CVE-2023-29295
Insecure Direct Object Reference (IDOR) in Create Quote Func - CVE-2023-29292
Server Side Request Forgery (SSRF) in FedEx carrier integrat - CVE-2023-29297
Admin-to-admin stored XSS via cache poisoning
Same vendor: Adobe
- CVE-2026-34632
Photoshop Installer | CWE-427: Uncontrolled Search Path Elem - CVE-2026-27297
Adobe Framemaker | Integer Underflow (Wrap or Wraparound) (C - CVE-2026-27300
Adobe Framemaker | Access of Uninitialized Pointer (CWE-824) - CVE-2026-27296
Adobe Framemaker | Integer Underflow (Wrap or Wraparound) (C - CVE-2026-27290
Adobe Framemaker | Untrusted Search Path (CWE-426)
Same weakness: CWE-639
- CVE-2026-8196
JeecgBoot mLogin Endpoint LoginController.java authorization - CVE-2026-42291
SysReptor: Read-write access to personal notes by sharing-li - CVE-2026-44400
MailEnable Enterprise Premium < 10.55 Authorization Bypass v - CVE-2026-42279
solidtime: Time entry update endpoint allows cross-organizat - CVE-2026-42277
Onyx: IDOR in /chat/file/{file_id} allows any authenticated
V. Comments for CVE-2021-21022
No comments yet