CVE-2021-21032 in Magento and Adobe Products
Published on February 11, 2021

Magento Commerce Failure To Invalidate User Session Could Lead To Unauthorized Access

Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) do not adequately invalidate user sessions. Successful exploitation of this issue could lead to unauthorized access to restricted resources. Access to the admin console is not required for successful exploitation.

NVD

Weakness Type

Insufficient Session Expiration

According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

Products Associated with CVE-2021-21032

stack.watch emails you whenever new vulnerabilities are published in Magento or Adobe Magento Commerce. Just hit a watch button to start following.

Magento

Adobe Magento Commerce

Affected Versions

Adobe Magento Commerce:

Version unspecified, <= 2.4.1 is affected.
Version unspecified, <= 2.4.0-p1 is affected.
Version unspecified, <= 2.3.6 is affected.
Version unspecified, <= None is affected.

Exploit Probability

EPSS

0.17%

Percentile

38.23%