HIGH8.8
GHSA-297f-r9w7-w492
Magento Improper input validation vulnerability
Quick fix
GHSA-297f-r9w7-w492 — magento/community-edition: upgrade to the fixed version with the command below.
composer require magento/community-edition:^2.3.7-p4Details
Adobe Commerce versions 2.4.3-p2 (and earlier), 2.3.7-p3 (and earlier) and 2.4.4 (and earlier) are affected by an improper input validation vulnerability. An authenticated attacker can trigger an insecure direct object reference in the `V1/customers/me` endpoint to achieve information exposure and privilege escalation.
Are you affected?
Enter the version of the package you're using.
Affected packages
Packagist/magento/community-edition
Introduced in:
0Fixed in: 2.3.7-p4Fix
composer require magento/community-edition:^2.3.7-p4Packagist/magento/community-edition
Introduced in:
2.4.0Fixed in: 2.4.3-p3Fix
composer require magento/community-edition:^2.4.3-p3Packagist/magento/community-edition
Introduced in:
2.4.4Fixed in: 2.4.5Fix
composer require magento/community-edition:^2.4.5