PT-2021-2308 · Adobe · Magento

Published 2021-02-09 · Updated 2024-03-06 · CVE-2021-21032

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions Magento versions 2.4.1 and earlier Magento versions 2.4.0-p1 and earlier Magento versions 2.3.6 and earlier

Description The issue is related to the inadequate invalidation of user sessions, which could lead to unauthorized access to restricted resources. Successful exploitation of this issue does not require access to the admin console. The vulnerability is also related to the lack of automatic termination of all sessions after a password change, allowing a remote attacker to gain unauthorized access to limited resources.

Recommendations For Magento versions 2.4.1 and earlier, update to a version that adequately invalidates user sessions after a password change. For Magento versions 2.4.0-p1 and earlier, update to a version that adequately invalidates user sessions after a password change. For Magento versions 2.3.6 and earlier, update to a version that adequately invalidates user sessions after a password change. As a temporary workaround, consider implementing a custom session invalidation mechanism after password changes until a patch is available.

Fix

Insufficient Session Expiration

Weakness Enumeration

CWE-613

Related Identifiers

BDU:2021-01542

BIT-MAGENTO-2021-21032

CVE-2021-21032

GHSA-4JFQ-F8HC-775Q

Affected Products

Magento

References · 8

• https://osv.dev/vulnerability/BIT-magento-2021-21032 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-21032 · Security Note
• https://helpx.adobe.com/security/products/magento/apsb21-08.html · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-4jfq-f8hc-775q · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-21032 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-01542 · Security Note
• https://github.com/magento/magento2 · Note
• https://t.me/cvenotify/9809 · Telegram Post