CVE-2021-21031

MEDIUM5.6EPSS 0.17%

Magento Insufficient Session Expiration

Published: 5/24/2022Modified: 2/10/2025

Also known as:GHSA-4h3p-63x6-vwg2BIT-magento-2021-21031

Description

Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) do not adequately invalidate user sessions. Successful exploitation could lead to unauthorized access to restricted resources. Access to the admin console is not required for successful exploitation.

Affected packages (3)

Bitnami/magentofrom 0, < 2.3.6, >= 2.4.0, < 2.4.1
Packagist/magento/community-edition>= 2.4.0, < 2.4.1-p1
Packagist/magento/project-community-editionfrom 0, <= 2.0.2

CVSS scores

Source	Version	Severity	Vector
osv	CVSS 3.1	MEDIUM5.6	CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

References (3)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2021-21031
PATCHhttps://github.com/magento/magento2
WEBhttps://helpx.adobe.com/security/products/magento/apsb21-08.html