CVE-2021-21024
published 2021-02-11CVE-2021-21024: Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are affected by a blind SQL injection vulnerability in the Search module…
PriorityP351critical9.1CVSS 3.0
AVNACLPRHUINSCCHIHAH
EPSS
2.77%
84.5th percentile
Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are affected by a blind SQL injection vulnerability in the Search module. Successful exploitation could lead to unauthorized access to restricted resources by an unauthenticated attacker. Access to the admin console is required for successful exploitation.
Affected
11 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| magento | community-edition | >= 0 < 2.3.6-p1 | 2.3.6-p1 |
| magento | community-edition | >= 2.4.0 < 2.4.1-p1 | 2.4.1-p1 |
| magento | magento | < 2.3.6 | 2.3.6 |
| magento | magento | — | — |
| magento | magento | — | — |
| magento | magento | — | — |
| openmage | magento | < 19.4.13 | 19.4.13 |
| openmage | magento | >= 20.0.0 < 20.0.9 | 20.0.9 |
| openmage | magento-lts | <= 19.4.12 | — |
| openmage | magento-lts | >= 0 < 19.4.13 | 19.4.13 |
| openmage | magento-lts | >= 20.0.0 < 20.0.9 | 20.0.9 |
CVSS provenance
nvdv3.09.1CRITICALCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
ghsa9.1CRITICAL
osv9.1CRITICAL
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
Magento Blind SQL Injection in the Search module
osv·2022-05-24
CVE-2021-21024 [CRITICAL] Magento Blind SQL Injection in the Search module
Magento Blind SQL Injection in the Search module
Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are affected by a blind SQL injection vulnerability in the Search module. Successful exploitation could lead to unauthorized access to restricted resources by an unauthenticated attacker. Access to the admin console is required for successful exploitation.
GHSA
Magento Blind SQL Injection in the Search module
ghsa·2022-05-24
CVE-2021-21024 [CRITICAL] CWE-89 Magento Blind SQL Injection in the Search module
Magento Blind SQL Injection in the Search module
Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are affected by a blind SQL injection vulnerability in the Search module. Successful exploitation could lead to unauthorized access to restricted resources by an unauthenticated attacker. Access to the admin console is required for successful exploitation.
OSV
Backport for CVE-2021-21024 Blind SQLi from Magento 2
osv·2021-04-22·CVSS 9.1
CVE-2021-21427 [CRITICAL] Backport for CVE-2021-21024 Blind SQLi from Magento 2
Backport for CVE-2021-21024 Blind SQLi from Magento 2
### Impact
This vulnerability allows an administrator unauthorized access to restricted resources.
We fixed a vulnerability in the MySQL adapter to prevent SQL injection attacks. This is a backport of CVE-2021-21024 https://helpx.adobe.com/security/products/magento/apsb21-08.html.
### Patches
_Has the problem been patched? What versions should users upgrade to?_
> v20.0.9 v19.4.13
GHSA
Backport for CVE-2021-21024 Blind SQLi from Magento 2
ghsa·2021-04-22·CVSS 9.1
CVE-2021-21427 [CRITICAL] CWE-89 Backport for CVE-2021-21024 Blind SQLi from Magento 2
Backport for CVE-2021-21024 Blind SQLi from Magento 2
### Impact
This vulnerability allows an administrator unauthorized access to restricted resources.
We fixed a vulnerability in the MySQL adapter to prevent SQL injection attacks. This is a backport of CVE-2021-21024 https://helpx.adobe.com/security/products/magento/apsb21-08.html.
### Patches
_Has the problem been patched? What versions should users upgrade to?_
> v20.0.9 v19.4.13
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2021-02-11
Published