← Database

CVE-2021-36012

MEDIUM CVSS: 6.5 Published: 2021-09-01 Modified: 2026-06-17

Description

Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a business logic error in the placeOrder graphql mutation. An authenticated attacker can leverage this vulnerability to altar the price of an item.

Affected Platforms

Adobe Magento Open SourceAdobe Adobe Commerce

Weakness Type

CWE-840, NVD-CWE-noinfo

References