Vulnerability advisory

CVE-2021-21027

Published Feb 11, 2021Updated Oct 24, 2026OSV record ↗

Also known as BIT-magento-2021-21027GHSA-h4xc-577p-hgj9

Severity

CVSS 3.xCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N

Affected versions

Repository

Affected commits	Fixed by commit
GIT github.com/magento/devdocs ↗
All commits before 9eba2c99bed83d8297c03b7ea3b110500cc5b955	`9eba2c99bed83d8297c03b7ea3b110500cc5b955`
9eba2c99bed83d8297c03b7ea3b110500cc5b955 through 9eba2c99bed83d8297c03b7ea3b110500cc5b955	No fix listed
Also listed as affected (20) `2.3.6-NA` `2.3.0` `2.2.7` `2.1.16` `1.x-eos` `2.3.5` `2.3.4` `2.3.3-p1` `2.2.11` `2.3.2` `2.2.9` `2.1.18` `2.3.1` `2.2.8` `2.1.17` `2.2.6` `2.1.15` `2.2.5` `2.1.14` `2.0.8`
GIT github.com/magento/magento2 ↗
All commits before 53ad434d78cd2d357203fb82e5ea059883f403b8	`53ad434d78cd2d357203fb82e5ea059883f403b8`
53ad434d78cd2d357203fb82e5ea059883f403b8 through 445b0f1a3d6a91b5da32d311077c2112ef0b1503	No fix listed
Also listed as affected (37) `2.3.6-NA` `2.4.0-NA` `2.4.0-p1` `2.4.1-NA` `2.4.1` `2.2.0-RC1.3` `2.2.0-RC1.2` `2.2.0-RC1.1` `2.1.0` `2.1.0-rc3` `2.1.0-rc2` `2.1.0-rc1` `2.0.0` `2.0.0-rc` `0.74.0-beta1` `0.42.0-beta3` `0.1.0-alpha108` `0.42.0-beta1` `0.1.0-alpha107` `0.1.0-alpha106` `0.1.0-alpha105` `0.1.0-alpha104` `0.1.0-alpha103` `0.1.0-alpha102` `0.1.0-alpha101` `0.1.0-alpha100` `0.1.0-alpha99` `0.1.0-alpha98` `0.1.0-alpha97` `0.1.0-alpha96` `0.1.0-alpha95` `0.1.0-alpha94` `0.1.0-alpha93` `0.1.0-alpha92` `0.1.0-alpha91` `0.1.0-alpha90` `0.1.0-alpha89`

Description

Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are affected by a cross-site request forgery (CSRF) vulnerability via the GraphQL API. Successful exploitation could lead to unauthorized modification of customer metadata by an unauthenticated attacker. Access to the admin console is not required for successful exploitation.

References

Advisoryhelpx.adobe.com/security/products/magento/apsb21-08.html ↗