Magento Commerce Gift Card Business Logic Error

Vulnerability

Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier), and 2.3.7 (and earlier) contain a business logic error in the placeOrder GraphQL mutation [1]. This vulnerability allows an authenticated attacker to modify the price of an item during order placement.

Exploitation

An attacker must be authenticated to the Magento instance and have the ability to send GraphQL requests. By manipulating the placeOrder mutation inputs, the attacker can alter the price of items in the order without proper validation [1].

Impact

Successful exploitation enables the attacker to purchase items at a lower price than intended, leading to financial loss for the merchant. The impact is limited to price manipulation and does not directly result in remote code execution or data disclosure [1].

Mitigation

No fix is mentioned in the available references [1]. Adobe has not publicly disclosed a patch for this vulnerability as of the reference publication date. Users should monitor official Adobe security advisories for updates.