by Kastro
Paper/Archive/CVE-2021-21024

CVE-2021-21024

Adobe Magento Commerce — Magento Commerce Blind SQL Injection Could Lead To Unauthorized Access

EPSS 3%CVSS 9.1
critical.is priorityof 100
45
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 86.3.863 × 2017.3No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are affected by a blind SQL injection vulnerability in the Search module. Successful exploitation could lead to unauthorized access to restricted resources by an unauthenticated attacker. Access to the admin console is required for successful exploitation.

Affected

ProductAffectedFixed inSource
Magento Commerceunspecified – 2.4.1–CNA
Magento Commerceunspecified – 2.4.0-p1–CNA
Magento Commerceunspecified – 2.3.6–CNA
Magento Commerceunspecified – None–CNA

Scores by source

adobe (CNA)9.1CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

References

refhelpx.adobe.com/security/products/magento/apsb21-08.html