Description

Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) do not adequately invalidate user sessions. Successful exploitation could lead to unauthorized access to restricted resources. Access to the admin console is not required for successful exploitation.

Remediation

References

CVE-2021-21031

Related Vulnerabilities

SugarCRM Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2019-14974)

Handlebars Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2015-8861)

WordPress Plugin VM Backups Cross-Site Request Forgery (1.0)

WordPress Plugin DukaPress SQL Injection (2.5.9)

Joomla! Core 3.x.x Directory Traversal (3.2.0 - 3.4.5)

Severity

Medium

Classification

CVE-2021-21031 CWE-613 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Tags

Missing Update Known Vulnerabilities