Description

Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) do not adequately invalidate user sessions. Successful exploitation of this issue could lead to unauthorized access to restricted resources. Access to the admin console is not required for successful exploitation.

Remediation

References

CVE-2021-21032

Related Vulnerabilities

Apache HTTP Server DEPRECATED: Code Vulnerability (CVE-2015-3183)

WordPress Plugin Custom Field Suite Cross-Site Request Forgery (2.5.15)

MySQL CVE-2020-14769 Vulnerability (CVE-2020-14769)

WordPress Plugin WordPress Facebook SQL Injection (1.0.8)

Zenphoto Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') Vulnerability (CVE-2007-6666)

Severity

Medium

Classification

CVE-2021-21032 CWE-613 CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Tags

Missing Update Known Vulnerabilities