PT-2021-2951 · Adobe · Magento

Published

2021-02-09

·

Updated

2024-03-06

·

CVE-2021-21024

CVSS v3.1

9.1

Critical

VectorAV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Magento versions 2.4.1 and earlier Magento versions 2.4.0-p1 and earlier Magento versions 2.3.6 and earlier
Description The issue is related to a lack of protection for SQL query structures in the Magento Commerce platform, which can be exploited by a remote attacker to gain unauthorized access to protected information with administrator privileges to the console. The vulnerability is a blind SQL injection in the Search module, allowing an unauthenticated attacker to access restricted resources if they have access to the admin console.
Recommendations For Magento versions 2.4.1 and earlier, update to a version that includes the fix for the blind SQL injection vulnerability in the Search module. For Magento versions 2.4.0-p1 and earlier, update to a version that includes the fix for the blind SQL injection vulnerability in the Search module. For Magento versions 2.3.6 and earlier, update to a version that includes the fix for the blind SQL injection vulnerability in the Search module. As a temporary workaround, consider restricting access to the admin console to minimize the risk of exploitation.

Fix

SQL injection

Weakness Enumeration

CWE-89

Related Identifiers

BDU:2021-02538
BIT-MAGENTO-2021-21024
CVE-2021-21024
GHSA-RJ4F-CP4V-HVCV

Affected Products

Magento