CVE-2021-21016

Summary (CVE-2021-21016) Magento Commerce/Open Source prior to fixes is vulnerable to an OS command injection via the WebAPI, potentially enabling remote code execution for an authenticated attacker with admin access. Affected versions include 2.4.1 (and earlier), 2.4.0-p1 (and earlier), and 2.3....

CVE-2021-21025 Magento Commerce XML Injection Could Lead To Arbitrary Code Execution

Magento versions 2.4.1 and earlier, 2.4.0-p1 and earlier and 2.3.6 and earlier are vulnerable to XML injection in the product layout updates. Successful exploitation could lead to arbitrary code execution by an authenticated attacker. Access to the admin console is required for successful...

CVE-2021-21018 Magnto Commerce Unauthorized Data Modification Could Lead To Arbitrary Code Execution

Magento versions 2.4.1 and earlier, 2.4.0-p1 and earlier and 2.3.6 and earlier are vulnerable to OS command injection via the scheduled operation module. Successful exploitation could lead to arbitrary code execution by an authenticated attacker. Access to the admin console is required for...

CVE-2021-21018

CVE-2021-21018 affects Magento Open Source/Commerce versions 2.4.1 and earlier, 2.4.0-p1 and earlier, and 2.3.6 and earlier. It is an OS command injection in the scheduled operation module that could allow an authenticated attacker with admin console access to achieve arbitrary code execution. Pu...

CVE-2021-21032

CVE-2021-21032 affects Magento Commerce/Open Source: Magento versions 2.4.1 and earlier, 2.4.0-p1 and earlier, and 2.3.6 and earlier fail to correctly invalidate user sessions, potentially allowing unauthorized access to restricted resources without admin console access. The root cause is insuffi...

CVE-2021-21032 Magento Commerce Failure To Invalidate User Session Could Lead To Unauthorized Access

Magento versions 2.4.1 and earlier, 2.4.0-p1 and earlier and 2.3.6 and earlier do not adequately invalidate user sessions. Successful exploitation of this issue could lead to unauthorized access to restricted resources. Access to the admin console is not required for successful exploitation...

CVE-2021-21029 Magento Commerce Reflected Cross-site Scripting Vulnerability Could Lead To Arbitrary JavaScript Execution

Magento versions 2.4.1 and earlier, 2.4.0-p1 and earlier and 2.3.6 and earlier are affected by a Reflected Cross-site Scripting vulnerability via 'file' parameter. Successful exploitation could lead to arbitrary JavaScript execution in the victim's browser. Access to the admin console is required...

CVE-2021-21025

CVE-2021-21025 impacts Magento Commerce/Open Source versions 2.4.1 and earlier, 2.4.0-p1 and earlier, and 2.3.6 and earlier. The issue is an XML injection vulnerability in the product layout updates that could allow an authenticated attacker with admin console access to achieve arbitrary code exe...

CVE-2021-21029

Summary of CVE-2021-21029 (Magento) Affected software: Magento Commerce / Magento Open Source (Magento versions 2.4.1 and earlier, 2.4.0-p1 and earlier, 2.3.6 and earlier). Vulnerability: Reflected Cross-site Scripting via the parameter. Successful exploitation could lead to arbitrary JavaScript...

CVE-2021-21023

Magento CVE-2021-21023 affects Magento Community/Open Source and related editions: versions 2.4.1 and earlier, 2.4.0-p1 and earlier, and 2.3.6 and earlier are vulnerable to a stored cross-site scripting (XSS) flaw in the admin console. Successful exploitation could lead to arbitrary JavaScript ex...

CVE-2021-21020 Magento Commerce Improper Access Control Vulnerability

Magento versions 2.4.1 and earlier, 2.4.0-p1 and earlier and 2.3.6 and earlier are vulnerable to an access control bypass vulnerability in the Login as Customer module. Successful exploitation could lead to unauthorized access to restricted resources...

CVE-2021-21027 Magento Commerce Cross-Site Request Forgery (CSRF) Could Lead To Unauthorized Data Modification

Magento versions 2.4.1 and earlier, 2.4.0-p1 and earlier and 2.3.6 and earlier are affected by a cross-site request forgery CSRF vulnerability via the GraphQL API. Successful exploitation could lead to unauthorized modification of customer metadata by an unauthenticated attacker. Access to the...

CVE-2021-21026 Magento Commerce Incorrect permissions Could Lead To Unauthorized Access

Magento versions 2.4.1 and earlier, 2.4.0-p1 and earlier and 2.3.6 and earlier are affected by an improper authorization vulnerability in the integrations module. Successful exploitation could lead to unauthorized access to restricted resources by an unauthenticated attacker. Access to the admin...

CVE-2021-21024

The CVE-2021-21024 entry details a blind SQL injection in Magento’s Search module affecting Magento Community editions up to 2.4.1 (and earlier) and 2.4.0-p1, 2.3.6 (and earlier). The underlying issue enables an unauthenticated attacker, with admin console access, to potentially view restricted r...

CVE-2021-21030 Magento Commerce Stored Cross-site Scripting Could Lead To Arbitrary Javascript Execution

Magento versions 2.4.1 and earlier, 2.4.0-p1 and earlier and 2.3.6 and earlier are vulnerable to a stored cross-site scripting XSS in the customer address upload feature. Successful exploitation could lead to arbitrary JavaScript execution in the victim's browser. Exploitation of this issue...

CVE-2021-21019 Magento Commerce XML Injection Could Lead To Remote Code Execution

Magento versions 2.4.1 and earlier, 2.4.0-p1 and earlier and 2.3.6 and earlier are vulnerable to XML injection in the Widgets module. Successful exploitation could lead to arbitrary code execution by an authenticated attacker. Access to the admin console is required for successful exploitation...

CVE-2021-21030

Magento Commerce/Open Source (Magento) version set 2.4.1 and earlier, 2.4.0-p1 and earlier, and 2.3.6 and earlier are affected by a stored XSS in the customer address upload feature. Successful exploitation could cause arbitrary JavaScript execution in the victim’s browser and requires user inter...

CVE-2021-21024 Magento Commerce Blind SQL Injection Could Lead To Unauthorized Access

Magento versions 2.4.1 and earlier, 2.4.0-p1 and earlier and 2.3.6 and earlier are affected by a blind SQL injection vulnerability in the Search module. Successful exploitation could lead to unauthorized access to restricted resources by an unauthenticated attacker. Access to the admin console is...

CVE-2021-21026

Magento exposes an improper authorization vulnerability in the integrations module affecting Magento Community/OOS and Commerce editions: versions 2.4.1 and earlier, 2.4.0-p1 and earlier, and 2.3.6 and earlier are impacted. The root cause is improper authorization, potentially allowing an unauthe...

CVE-2021-21020

CVE-2021-21020 affects Magento Open Source and Commerce: Magento versions 2.4.1 and earlier, 2.4.0-p1 and earlier, and 2.3.6 and earlier are vulnerable to an access control bypass in the Login as Customer module , potentially allowing unauthorized access to restricted resources. The connected sou...