Magento Commerce `quoteId` parameter Incorrect Authorization Vulnerability Could Lead To Information Disclosure

Vulnerability

Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier), and 2.3.7 (and earlier) are affected by an improper input validation vulnerability in the quoteId parameter. This allows an attacker to disclose sensitive information [1].

Exploitation

An attacker can send a specially crafted request with a malicious quoteId parameter to exploit the vulnerability. No authentication is required, and the attack can be performed remotely [1].

Impact

Successful exploitation leads to the disclosure of sensitive information, such as customer data or order details, potentially compromising user privacy.

Mitigation

Not explicitly mentioned in the reference, but upgrading to a version later than 2.4.2, 2.4.2-p1, or 2.3.7 should mitigate the vulnerability. Adobe recommends applying the latest security updates.