Description

Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) do not adequately invalidate user sessions. Successful exploitation of this issue could lead to unauthorized access to restricted resources. Access to the admin console is not required for successful exploitation.

Remediation

References

CVE-2021-21032

Related Vulnerabilities

Microsoft SQL Server Improper Input Validation Vulnerability (CVE-2001-0509)

e107 Cross-Site Request Forgery (CSRF) Vulnerability (CVE-2018-15901)

PHP Improper Input Validation Vulnerability (CVE-2015-4605)

WordPress Plugin Formidable Forms-Contact Form, Survey, Quiz, Calculator & Custom Form Builder PHP Object Injection (4.02)

WordPress Plugin WP Database Backup Cross-Site Request Forgery (5.1.2)

Severity

Medium

Classification

CVE-2021-21032 CWE-613 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Tags

Missing Update Known Vulnerabilities