CVE-2021-36038

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2021-36038
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2021-36038.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2021-36038
Aliases
Published
2021-09-01T15:15:09.977Z
Modified
2026-05-28T04:04:36.667666659Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N CVSS Calculator
Summary
[none]
Details

Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability in the Multishipping Module. An authenticated attacker could leverage this vulnerability to achieve sensitive information disclosure.

Database specific 
{
    "unresolved_ranges": [
        {
            "cpes": [
                "cpe:2.3:a:adobe:adobe_commerce:*:*:*:*:*:*:*:*"
            ],
            "extracted_events": [
                {
                    "introduced": "2.3.0"
                },
                {
                    "last_affected": "2.3.7"
                },
                {
                    "introduced": "2.4.0"
                },
                {
                    "last_affected": "2.4.2"
                }
            ],
            "source": "CPE_RANGE",
            "vendor_product": "adobe:adobe_commerce"
        },
        {
            "cpes": [
                "cpe:2.3:a:adobe:adobe_commerce:2.4.2:p1:*:*:*:*:*:*"
            ],
            "source": "CPE_STRING",
            "extracted_events": [
                {
                    "last_affected": "2.4.2-p1"
                }
            ],
            "vendor_product": "adobe:adobe_commerce"
        }
    ]
}
References

Affected packages

Git / github.com/magento/magento2

Affected ranges

Type
GIT
Repo
https://github.com/magento/magento2
Events
Introduced
f4c1d7526f05bdfb1327b0701cc345f94aadcaed
Last affected
44a7b6079bcac5ba92040b16f4f74024b4f34d09
Introduced
6729b6e01368248abc33300208eb292c95050203
Last affected
33242e4b19cf207d7b73f7791ef894b48bb41f8a
Introduced
0 Unknown introduced commit / All previous commits are affected
Last affected
1bd5cb8c065e44779526c0b044ce19b884707695
Database specific 
{
    "cpe": [
        "cpe:2.3:a:adobe:magento_open_source:*:*:*:*:*:*:*:*",
        "cpe:2.3:a:adobe:magento_open_source:2.4.2:p1:*:*:*:*:*:*"
    ],
    "source": [
        "CPE_RANGE",
        "CPE_STRING"
    ],
    "extracted_events": [
        {
            "introduced": "2.3.0"
        },
        {
            "last_affected": "2.3.7"
        },
        {
            "introduced": "2.4.0"
        },
        {
            "last_affected": "2.4.2"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "2.4.2-p1"
        }
    ]
}

Affected versions

0.*
0.1.0-alpha100
0.1.0-alpha101
0.1.0-alpha102
0.1.0-alpha103
0.1.0-alpha104
0.1.0-alpha105
0.1.0-alpha106
0.1.0-alpha107
0.1.0-alpha108
0.1.0-alpha89
0.1.0-alpha90
0.1.0-alpha91
0.1.0-alpha92
0.1.0-alpha93
0.1.0-alpha94
0.1.0-alpha95
0.1.0-alpha96
0.1.0-alpha97
0.1.0-alpha98
0.1.0-alpha99
0.42.0-beta1
0.42.0-beta3
0.74.0-beta1
2.*
2.0.0
2.0.0-rc
2.1.0
2.1.0-rc1
2.1.0-rc2
2.1.0-rc3
2.2.0-RC1.1
2.2.0-RC1.2
2.2.0-RC1.3
2.3.7
2.4.2
2.4.2-p1

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2021-36038.json"