GitHub Advisoryadvisory · Packagist

GHSA-4h3p-63x6-vwg2 Magento Insufficient Session Expiration

MEDIUM Published 2022-05-24 Modified 2025-02-10 Official page ↗
Aliases
CVE-2021-21031
Ecosystem
Packagist
Packages
magento/community-edition, magento/project-community-edition
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Weaknesses
CWE-613
Reviewed
2024-01-10

Affected packages

• Packagist magento/community-edition: >= 2.4.0, < 2.4.1-p1 → fixed in 2.4.1-p1 • Packagist magento/community-edition: < 2.3.6 → fixed in 2.3.6 • Packagist magento/project-community-edition: <= 2.0.2 (no fix yet)

Description

Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) do not adequately invalidate user sessions. Successful exploitation could lead to unauthorized access to restricted resources. Access to the admin console is not required for successful exploitation.

Related

Weakness · not in database (1)

Alias · CVE (1)

  • CVE-2021-21031 Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) do not adequately invalidate user sessions. vulnerability

References