GitHub Advisoryadvisory · Packagist

GHSA-4jfq-f8hc-775q Magento Insufficient Session Expiration

MEDIUM Published 2022-05-24 Modified 2025-02-10 Official page ↗
Aliases
CVE-2021-21032
Ecosystem
Packagist
Packages
magento/community-edition, magento/project-community-edition
Severity
Moderate
CVSS vector
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
Weaknesses
CWE-613
Reviewed
2024-01-10

Affected packages

• Packagist magento/community-edition: >= 2.4.0, < 2.4.1-p1 → fixed in 2.4.1-p1 • Packagist magento/community-edition: < 2.3.6 → fixed in 2.3.6 • Packagist magento/project-community-edition: <= 2.0.2 (no fix yet)

Description

Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) do not adequately invalidate user sessions. Successful exploitation of this issue could lead to unauthorized access to restricted resources. Access to the admin console is not required for successful exploitation.

Related

Weakness · not in database (1)

Alias · CVE (1)

  • CVE-2021-21032 Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) do not adequately invalidate user sessions. vulnerability

References