CVE-2021-21024: Magento Blind SQL Injection in the Search module
Magento Blind SQL Injection in the Search module
Other sources
Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are affected by a blind SQL injection vulnerability in the Search module. Successful exploitation could lead to unauthorized access to restricted resources by an unauthenticated attacker. Access to the admin console is required for successful exploitation.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/magento/community-editionto a version that resolves this vulnerability.Fixed in 2.4.1-p1 - Upgrade
Upgrade
composer/magento/community-editionto a version that resolves this vulnerability.Fixed in 2.3.6-p1
Event History
Frequently Asked Questions
What is the vulnerability ID for this Magento vulnerability?
The vulnerability ID for this Magento vulnerability is CVE-2021-21024.
Which versions of Magento are affected by this vulnerability?
Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier), and 2.3.6 (and earlier) are affected by this vulnerability.
What is the severity rating of CVE-2021-21024?
The severity rating of CVE-2021-21024 is critical with a CVSS score of 9.1.
What is the impact of this vulnerability?
Successful exploitation of this vulnerability could lead to unauthorized access to restricted resources by an unauthenticated attacker.
Where can I find more information about this vulnerability?
You can find more information about this vulnerability at the following link: [Adobe Security Bulletin](https://helpx.adobe.com/security/products/magento/apsb21-08.html).