CVE-2021-21024: Magento Commerce Blind SQL Injection Could Lead To Unauthorized Access
Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are affected by a blind SQL injection vulnerability in the Search module. Successful exploitation could lead to unauthorized access to restricted resources by an unauthenticated attacker. Access to the admin console is required for successful exploitation.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this Magento vulnerability?
The vulnerability ID for this Magento vulnerability is CVE-2021-21024.
Which versions of Magento are affected by this vulnerability?
Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier), and 2.3.6 (and earlier) are affected by this vulnerability.
What is the severity rating of CVE-2021-21024?
The severity rating of CVE-2021-21024 is critical with a CVSS score of 9.1.
What is the impact of this vulnerability?
Successful exploitation of this vulnerability could lead to unauthorized access to restricted resources by an unauthenticated attacker.
Where can I find more information about this vulnerability?
You can find more information about this vulnerability at the following link: [Adobe Security Bulletin](https://helpx.adobe.com/security/products/magento/apsb21-08.html).