Vulnerability advisory

CVE-2021-28563

Published Jun 28, 2021Updated Oct 24, 2026OSV record ↗

Also known as BIT-magento-2021-28563GHSA-q9xx-4689-gvv5

Severity

CVSS 3.xCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N

Affected versions

Repository

Affected commits	Fixed by commit
GIT github.com/magento/devdocs ↗
All commits through 9eba2c99bed83d8297c03b7ea3b110500cc5b955	No fix listed
Also listed as affected (22) `2.3.0` `2.2.7` `2.1.16` `2.4.2` `2.4.1-p1` `2.3.6-p1` `1.x-eos` `2.3.5` `2.3.4` `2.3.3-p1` `2.2.11` `2.3.2` `2.2.9` `2.1.18` `2.3.1` `2.2.8` `2.1.17` `2.2.6` `2.1.15` `2.2.5` `2.1.14` `2.0.8`
GIT github.com/magento/magento2 ↗
All commits before 44a7b6079bcac5ba92040b16f4f74024b4f34d09	`44a7b6079bcac5ba92040b16f4f74024b4f34d09`
6729b6e01368248abc33300208eb292c95050203 through 33242e4b19cf207d7b73f7791ef894b48bb41f8a	No fix listed
Also listed as affected (33) `2.4.2` `2.2.0-RC1.3` `2.2.0-RC1.2` `2.2.0-RC1.1` `2.1.0` `2.1.0-rc3` `2.1.0-rc2` `2.1.0-rc1` `2.0.0` `2.0.0-rc` `0.74.0-beta1` `0.42.0-beta3` `0.1.0-alpha108` `0.42.0-beta1` `0.1.0-alpha107` `0.1.0-alpha106` `0.1.0-alpha105` `0.1.0-alpha104` `0.1.0-alpha103` `0.1.0-alpha102` `0.1.0-alpha101` `0.1.0-alpha100` `0.1.0-alpha99` `0.1.0-alpha98` `0.1.0-alpha97` `0.1.0-alpha96` `0.1.0-alpha95` `0.1.0-alpha94` `0.1.0-alpha93` `0.1.0-alpha92` `0.1.0-alpha91` `0.1.0-alpha90` `0.1.0-alpha89`

Description

Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are affected by an Improper Authorization vulnerability via the 'Create Customer' endpoint. Successful exploitation could lead to unauthorized modification of customer data by an unauthenticated attacker. Access to the admin console is required for successful exploitation.

References

Advisoryhelpx.adobe.com/security/products/magento/apsb21-30.html ↗