Vulnerability advisory

CVE-2021-21032

Published Feb 11, 2021Updated Oct 24, 2026OSV record ↗

Also known as BIT-magento-2021-21032GHSA-4jfq-f8hc-775q

Severity

CVSS 3.xCVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Affected versions

Repository

Affected commits	Fixed by commit
GIT github.com/magento/devdocs ↗
All commits before 9eba2c99bed83d8297c03b7ea3b110500cc5b955	`9eba2c99bed83d8297c03b7ea3b110500cc5b955`
9eba2c99bed83d8297c03b7ea3b110500cc5b955 through 9eba2c99bed83d8297c03b7ea3b110500cc5b955	No fix listed
Also listed as affected (20) `2.3.6-NA` `2.3.0` `2.2.7` `2.1.16` `1.x-eos` `2.3.5` `2.3.4` `2.3.3-p1` `2.2.11` `2.3.2` `2.2.9` `2.1.18` `2.3.1` `2.2.8` `2.1.17` `2.2.6` `2.1.15` `2.2.5` `2.1.14` `2.0.8`
GIT github.com/magento/magento2 ↗
All commits before 53ad434d78cd2d357203fb82e5ea059883f403b8	`53ad434d78cd2d357203fb82e5ea059883f403b8`
53ad434d78cd2d357203fb82e5ea059883f403b8 through 445b0f1a3d6a91b5da32d311077c2112ef0b1503	No fix listed
Also listed as affected (37) `2.3.6-NA` `2.4.0-NA` `2.4.0-p1` `2.4.1-NA` `2.4.1` `2.2.0-RC1.3` `2.2.0-RC1.2` `2.2.0-RC1.1` `2.1.0` `2.1.0-rc3` `2.1.0-rc2` `2.1.0-rc1` `2.0.0` `2.0.0-rc` `0.74.0-beta1` `0.42.0-beta3` `0.1.0-alpha108` `0.42.0-beta1` `0.1.0-alpha107` `0.1.0-alpha106` `0.1.0-alpha105` `0.1.0-alpha104` `0.1.0-alpha103` `0.1.0-alpha102` `0.1.0-alpha101` `0.1.0-alpha100` `0.1.0-alpha99` `0.1.0-alpha98` `0.1.0-alpha97` `0.1.0-alpha96` `0.1.0-alpha95` `0.1.0-alpha94` `0.1.0-alpha93` `0.1.0-alpha92` `0.1.0-alpha91` `0.1.0-alpha90` `0.1.0-alpha89`

Description

Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) do not adequately invalidate user sessions. Successful exploitation of this issue could lead to unauthorized access to restricted resources. Access to the admin console is not required for successful exploitation.

References

Advisoryhelpx.adobe.com/security/products/magento/apsb21-08.html ↗