CVE-2021-36012 Magento Commerce Gift Card Business Logic Error

What is CVE-2021-36012?

CVE-2021-36012 is a medium-severity vulnerability in Adobe Magento Commerce, published on 1 Sep 2021. Any signed-in user can exploit it over the network, with no action from the victim.

Official description

Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a business logic error in the placeOrder graphql mutation. An authenticated attacker can leverage this vulnerability to altar the price of an item.

Weakness: CWE-840

Which versions are affected by CVE-2021-36012?

8 open source packages ship an affected version, including magento/community-edition and magento/project-community-edition. It affects 2 products.

Products include Adobe Adobe Commerce, Adobe Magento Open Source.

How do I fix CVE-2021-36012?

Upgrade magento/community-edition to a fixed version for your release line: 2.3.7-p1 or 2.4.2-p2.

Is CVE-2021-36012 being exploited?

There is no known exploitation of CVE-2021-36012 in the wild and no public exploit code.

Other vulnerabilities in Adobe Magento Commerce

• CVE-2021-36022 Magento Commerce Widgets Update Layout XML Injection Vulnerability Could Lead To Remote Code Execution Critical 9.1
• CVE-2021-36024 Magento Commerce Improper Neutralization of Special Elements Used In A Command Critical 9.1
• CVE-2021-36025 Magento Commerce Customer Edition Improper Input Validation Could Lead To Remote Code Execution Critical 9.1
• CVE-2021-36028 Magento Commerce XML Injection Vulnerability Could Lead To Remote Code Execution Critical 9.1
• CVE-2021-36029 Magento Commerce Improper Authorization Vulnerability Could Lead To Remote Code Execution Critical 9.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-3f97-7pgv-gmgr.