{"id":"CVE-2021-36044","published":"2021-09-01T14:32:31Z","modified":"2024-09-16T19:57:02Z","title":"Magento Commerce GraphQL Improper Input Validation Could Lead To Denial Of Service","vendor":"Adobe","product":"Magento Commerce","tier":"tail","description":{"text":"Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability. An unauthenticated attacker could abuse this vulnerability to cause a server-side denial-of-service using a GraphQL field.","provenance":"source","from":"CVE.org"},"cvss":{"score":7.5,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.02013,"percentile":0.80812,"provenance":"source"},"cwes":[{"id":"CWE-20","name":"Improper Input Validation"}],"references":[{"url":"https://helpx.adobe.com/security/products/magento/apsb21-64.html","tags":["x_refsource_MISC"]}],"priority":{"score":21.4,"factors":[{"name":"EPSS percentile","points":16.16},{"name":"CVSS severity","points":5.25}]},"vendorSlug":"adobe","affectedVersions":[{"vendor":"Adobe","product":"Magento Commerce","versions":[">= unspecified, <= 2.4.2",">= unspecified, <= 2.4.2-p1",">= unspecified, <= 2.3.7",">= unspecified, <= None"]}],"affected":[{"ecosystem":"Packagist","package":"magento/project-community-edition","vulnerableRanges":["<=2.0.2"],"patched":[],"from":["GHSA-wr57-3h2f-3q95"],"provenance":"source"},{"ecosystem":"Packagist","package":"magento/community-edition","vulnerableRanges":[">=2.4.2-p1, <2.4.2-p2","<2.3.7-p1"],"patched":["2.4.2-p2","2.3.7-p1"],"from":["GHSA-wr57-3h2f-3q95"],"provenance":"source"}],"euvd":{"id":"EUVD-2021-22677","exploited":false,"provenance":"source"}}