Vulnerability Details CVE-2021-36012
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a business logic error in the placeOrder graphql mutation. An authenticated attacker can leverage this vulnerability to altar the price of an item.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.008
EPSS Ranking 72.7%
CVSS Severity
CVSS v3 Score 6.5
CVSS v2 Score 4.0
References
Products affected by CVE-2021-36012
-
cpe:2.3:a:adobe:adobe_commerce:*
-
cpe:2.3:a:adobe:adobe_commerce:2.4.2
-
cpe:2.3:a:adobe:magento_open_source:2.3.7
-
cpe:2.3:a:adobe:magento_open_source:2.4.0
-
cpe:2.3:a:adobe:magento_open_source:2.4.1
-
cpe:2.3:a:adobe:magento_open_source:2.4.2