Description

Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are affected by a blind SQL injection vulnerability in the Search module. Successful exploitation could lead to unauthorized access to restricted resources by an unauthenticated attacker. Access to the admin console is required for successful exploitation.

Remediation

References

CVE-2021-21024

Related Vulnerabilities

PostgreSQL Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') Vulnerability (CVE-2014-0062)

WebLogic Improper Input Validation Vulnerability (CVE-2020-10693)

WordPress Plugin WordPress Infinite Scroll-Ajax Load More Local File Inclusion (2.11.1)

MySQL CVE-2016-0650 Vulnerability (CVE-2016-0650)

CKEditor Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2022-24728)

Severity

Critical

Classification

CVE-2021-21024 CWE-138 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities