Command injection

Magento versions 2.4.1 and earlier, 2.4.0-p1 and earlier and 2.3.6 and earlier are vulnerable to OS command injection via the scheduled operation module. Successful exploitation could lead to arbitrary code execution by an authenticated attacker. Access to the admin console is required for...

Authentication flaw

Magento versions 2.4.1 and earlier, 2.4.0-p1 and earlier and 2.3.6 and earlier do not adequately invalidate user sessions. Successful exploitation of this issue could lead to unauthorized access to restricted resources. Access to the admin console is not required for successful exploitation...

Command injection

Magento versions 2.4.1 and earlier, 2.4.0-p1 and earlier and 2.3.6 and earlier are vulnerable to an OS command injection via the customer attribute save controller. Successful exploitation could lead to arbitrary code execution by an authenticated attacker. Access to the admin console is required...

Authentication flaw

Magento versions 2.4.1 and earlier, 2.4.0-p1 and earlier and 2.3.6 and earlier are vulnerable to an insecure direct object reference IDOR in the product module. Successful exploitation could lead to unauthorized access to restricted resources...

CVE-2021-21016 Magento Commerce Unauthorized Data Modification Could Lead to Arbitrary Code Execution

Magento versions 2.4.1 and earlier, 2.4.0-p1 and earlier and 2.3.6 and earlier are vulnerable to OS command injection via the WebAPI. Successful exploitation could lead to remote code execution by an authenticated attacker. Access to the admin console is required for successful exploitation...

CVE-2021-21016

Summary (CVE-2021-21016) Magento Commerce/Open Source prior to fixes is vulnerable to an OS command injection via the WebAPI, potentially enabling remote code execution for an authenticated attacker with admin access. Affected versions include 2.4.1 (and earlier), 2.4.0-p1 (and earlier), and 2.3....

CVE-2021-21032 Magento Commerce Failure To Invalidate User Session Could Lead To Unauthorized Access

Magento versions 2.4.1 and earlier, 2.4.0-p1 and earlier and 2.3.6 and earlier do not adequately invalidate user sessions. Successful exploitation of this issue could lead to unauthorized access to restricted resources. Access to the admin console is not required for successful exploitation...

CVE-2021-21018 Magnto Commerce Unauthorized Data Modification Could Lead To Arbitrary Code Execution

Magento versions 2.4.1 and earlier, 2.4.0-p1 and earlier and 2.3.6 and earlier are vulnerable to OS command injection via the scheduled operation module. Successful exploitation could lead to arbitrary code execution by an authenticated attacker. Access to the admin console is required for...

CVE-2021-21029

Summary of CVE-2021-21029 (Magento) Affected software: Magento Commerce / Magento Open Source (Magento versions 2.4.1 and earlier, 2.4.0-p1 and earlier, 2.3.6 and earlier). Vulnerability: Reflected Cross-site Scripting via the parameter. Successful exploitation could lead to arbitrary JavaScript...

CVE-2021-21032

CVE-2021-21032 affects Magento Commerce/Open Source: Magento versions 2.4.1 and earlier, 2.4.0-p1 and earlier, and 2.3.6 and earlier fail to correctly invalidate user sessions, potentially allowing unauthorized access to restricted resources without admin console access. The root cause is insuffi...

CVE-2021-21029 Magento Commerce Reflected Cross-site Scripting Vulnerability Could Lead To Arbitrary JavaScript Execution

Magento versions 2.4.1 and earlier, 2.4.0-p1 and earlier and 2.3.6 and earlier are affected by a Reflected Cross-site Scripting vulnerability via 'file' parameter. Successful exploitation could lead to arbitrary JavaScript execution in the victim's browser. Access to the admin console is required...

CVE-2021-21025

CVE-2021-21025 impacts Magento Commerce/Open Source versions 2.4.1 and earlier, 2.4.0-p1 and earlier, and 2.3.6 and earlier. The issue is an XML injection vulnerability in the product layout updates that could allow an authenticated attacker with admin console access to achieve arbitrary code exe...

CVE-2021-21025 Magento Commerce XML Injection Could Lead To Arbitrary Code Execution

Magento versions 2.4.1 and earlier, 2.4.0-p1 and earlier and 2.3.6 and earlier are vulnerable to XML injection in the product layout updates. Successful exploitation could lead to arbitrary code execution by an authenticated attacker. Access to the admin console is required for successful...

CVE-2021-21018

CVE-2021-21018 affects Magento Open Source/Commerce versions 2.4.1 and earlier, 2.4.0-p1 and earlier, and 2.3.6 and earlier. It is an OS command injection in the scheduled operation module that could allow an authenticated attacker with admin console access to achieve arbitrary code execution. Pu...

CVE-2021-21030 Magento Commerce Stored Cross-site Scripting Could Lead To Arbitrary Javascript Execution

Magento versions 2.4.1 and earlier, 2.4.0-p1 and earlier and 2.3.6 and earlier are vulnerable to a stored cross-site scripting XSS in the customer address upload feature. Successful exploitation could lead to arbitrary JavaScript execution in the victim's browser. Exploitation of this issue...

CVE-2021-21027

CVE-2021-21027 is a Magento CSRF vulnerability affecting Magento Open Source/Commerce 2.x (2.4.1 and earlier, 2.4.0-p1 and earlier, 2.3.6 and earlier). It allows an unauthenticated attacker to trigger cross-site request forgery via the GraphQL API, potentially modifying customer metadata without ...

CVE-2021-21027 Magento Commerce Cross-Site Request Forgery (CSRF) Could Lead To Unauthorized Data Modification

Magento versions 2.4.1 and earlier, 2.4.0-p1 and earlier and 2.3.6 and earlier are affected by a cross-site request forgery CSRF vulnerability via the GraphQL API. Successful exploitation could lead to unauthorized modification of customer metadata by an unauthenticated attacker. Access to the...

CVE-2021-21022

Magento Commerce/Open Source versions 2.4.1 and earlier, 2.4.0-p1 and earlier, and 2.3.6 and earlier are affected by an insecure direct object reference (IDOR) in the product module, enabling unauthorized access to restricted resources. The issue is a direct object reference vulnerability (IDOR) ...

CVE-2021-21024

The CVE-2021-21024 entry details a blind SQL injection in Magento’s Search module affecting Magento Community editions up to 2.4.1 (and earlier) and 2.4.0-p1, 2.3.6 (and earlier). The underlying issue enables an unauthenticated attacker, with admin console access, to potentially view restricted r...

CVE-2021-21026 Magento Commerce Incorrect permissions Could Lead To Unauthorized Access

Magento versions 2.4.1 and earlier, 2.4.0-p1 and earlier and 2.3.6 and earlier are affected by an improper authorization vulnerability in the integrations module. Successful exploitation could lead to unauthorized access to restricted resources by an unauthenticated attacker. Access to the admin...