Magento Commerce Improper Input Validation During Checkout Process Could Lead To Privilege Escalation

Vulnerability

Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier), and 2.3.7 (and earlier) are affected by an improper input validation vulnerability during the checkout process [1]. This allows an attacker to manipulate item prices without proper validation.

Exploitation

An unauthenticated attacker can exploit this vulnerability by sending crafted input during the checkout process, bypassing price validation checks. No authentication or special privileges are required.

Impact

Successful exploitation enables the attacker to alter the price of items, potentially purchasing products at a lower cost or causing financial loss to the merchant.

Mitigation

No fix or workaround is disclosed in the available references [1][2]. Users are advised to monitor vendor advisories for patches.