{"id":"CVE-2021-21013","aliases":["EUVD-2021-8422","GHSA-5ffv-cqpm-6p2j"],"status":"published","title":"Magento Commerce Insecure Direct Object Reference Could Lead To Information Disclosure","description":"Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to an insecure direct object vulnerability (IDOR) in the customer API module. Successful exploitation could lead to sensitive information disclosure and update arbitrary information on another user's account.","severity":{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.03035,"percentile":0.87613,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-639","CWE-787","CWE-863"],"published":"2021-01-13T22:35:54Z","modified":"2026-10-24T10:30:20Z","products":[{"vendor":"adobe","product":"magento"},{"vendor":"adobe","product":"magento commerce"}],"references":[{"url":"https://helpx.adobe.com/security/products/magento/apsb21-08.html","tags":["x_refsource_MISC","x_transferred","Release Notes","Vendor Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-21013"},{"url":"https://helpx.adobe.com/security/products/bridge/apsb21-07.html"},{"url":"https://github.com/advisories/GHSA-5ffv-cqpm-6p2j"}],"sources":{"cve":[{"id":"CVE-2021-21013","title":"Magento Commerce Insecure Direct Object Reference Could Lead To Information Disclosure","description":"Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to an insecure direct object vulnerability (IDOR) in the customer API module. Successful exploitation could lead to sensitive information disclosure and update arbitrary information on another user's account.","status":"published","published":"2021-01-13T22:35:54.37Z","modified":"2024-09-17T02:28:00.147Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"cna"}],"cwes":["CWE-863"],"updated_at":"2026-11-02T14:33:00.137099Z"}],"euvd":[{"id":"EUVD-2021-8422","description":"Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to an insecure direct object vulnerability (IDOR) in the customer API module. Successful exploitation could lead to sensitive information disclosure and update arbitrary information on another user's account.","status":"published","published":"2021-01-13T22:35:54Z","modified":"2024-09-17T02:28:00Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-03T00:28:39.983112Z"}],"ghsa":[{"id":"GHSA-5ffv-cqpm-6p2j","title":"Adobe Bridge version 11.0 (and earlier) is affected by an out-of-bounds write vulnerability when...","description":"Adobe Bridge version 11.0 (and earlier) is affected by an out-of-bounds write vulnerability when parsing TTF files that could result in arbitrary code execution in the context of the current user. Exploitation of this issue requires user interaction in that a victim must open a malicious file.","status":"published","published":"2022-05-24T17:39:22Z","modified":"2023-01-27T05:03:32Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-639","CWE-787","CWE-863"],"updated_at":"2026-11-02T14:42:16.196802Z"}],"nvd":[{"id":"CVE-2021-21013","description":"Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to an insecure direct object vulnerability (IDOR) in the customer API module. Successful exploitation could lead to sensitive information disclosure and update arbitrary information on another user's account.","status":"published","published":"2021-01-13T23:15:14.493Z","modified":"2026-06-17T03:34:39.753Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5.5,"vector":"AV:N/AC:L/Au:S/C:P/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-863","CWE-639"],"updated_at":"2026-11-02T14:06:49.284888Z"}],"osv":[{"id":"CVE-2021-21013","description":"Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to an insecure direct object vulnerability (IDOR) in the customer API module. Successful exploitation could lead to sensitive information disclosure and update arbitrary information on another user's account.","status":"published","published":"2021-01-13T23:15:14.493Z","modified":"2026-10-24T10:30:20.459928547Z","cvss":[{"version":"3.1","score":8.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:44:18.004149Z"}]}}