GitHub Advisoryadvisory · Packagist

GHSA-fvrf-9428-527m Backport for CVE-2021-21024 Blind SQLi from Magento 2

CRITICAL Published 2021-04-22 Modified 2021-04-30 Official page ↗
Aliases
CVE-2021-21427
Ecosystem
Packagist
Packages
openmage/magento-lts
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Weaknesses
CWE-89
Reviewed
2021-04-21

Affected packages

• Packagist openmage/magento-lts: < 19.4.13 → fixed in 19.4.13 • Packagist openmage/magento-lts: >= 20.0.0, < 20.0.9 → fixed in 20.0.9

Description

Impact This vulnerability allows an administrator unauthorized access to restricted resources. We fixed a vulnerability in the MySQL adapter to prevent SQL injection attacks. This is a backport of CVE-2021-21024 https://helpx.adobe.com/security/products/magento/apsb21-08.html. Patches _Has the problem been patched? What versions should users upgrade to?_ > v20.0.9 v19.4.13

Related

Alias · CVE (1)

  • CVE-2021-21427 Magento-lts is a long-term support alternative to Magento Community Edition (CE). vulnerability

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References