Lucene search

GoogleOSV:BIT-MAGENTO-2021-21032

HistoryMar 06, 2024 - 10:59 a.m.

BIT-magento-2021-21032

2024-03-0610:59:18

Google

osv.dev

magento

user sessions

unauthorized access

admin console

exploitation

6.7 Medium

AI Score

Confidence

Low

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.003 Low

EPSS

Percentile

67.7%

JSON

Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) do not adequately invalidate user sessions. Successful exploitation of this issue could lead to unauthorized access to restricted resources. Access to the admin console is not required for successful exploitation.

CPENameOperatorVersion
magentoge2.4.0-p1
magentoge2.3.6
magentoge2.4.0
magentolt2.3.6
magentole2.4.0-p1
magentole2.3.6
magentole2.4.0
magentoge2.4.1
magentole2.4.1

Name	Operator	Version
magento	ge	2.4.0-p1
magento	ge	2.3.6
magento	ge	2.4.0
magento	lt	2.3.6
magento	le	2.4.0-p1
magento	le	2.3.6
magento	le	2.4.0
magento	ge	2.4.1
magento	le	2.4.1

References

helpx.adobe.com/security/products/magento/apsb21-08.html

6.7 Medium

AI Score

Confidence

Low

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.003 Low

EPSS

Percentile

67.7%

JSON

Related for OSV:BIT-MAGENTO-2021-21032