Magento Commerce Improper Input Validation Could Lead To Information Exposure and Privilege Escalation

Vulnerability

An improper input validation vulnerability exists in Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier), and 2.3.7 (and earlier). The flaw is an insecure direct object reference (IDOR) in the V1/customers/me endpoint, which fails to properly validate that the authenticated user is authorized to access the requested customer resource [1].

Exploitation

An authenticated attacker can exploit this vulnerability by sending crafted requests to the V1/customers/me endpoint, manipulating parameters to reference other customer records. No special network position or write access is required; only valid authentication credentials are needed [1].

Impact

Successful exploitation leads to information exposure of other customers' data and potential privilege escalation. The attacker may view sensitive personal information and gain elevated access within the application [1].

Mitigation

As of the publication date, no official patch has been released. Adobe has not disclosed a fixed version in the available references. Users are advised to monitor security advisories and apply updates when they become available [1].