7.5

CVE-2021-21032

Magento Commerce Failure To Invalidate User Session Could Lead To Unauthorized Access

Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) do not adequately invalidate user sessions. Successful exploitation of this issue could lead to unauthorized access to restricted resources. Access to the admin console is not required for successful exploitation.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Magento ≫ Magento SwEdition commerce Version < 2.3.6
Magento ≫ Magento SwEdition open_source Version < 2.3.6
Magento ≫ Magento Version 2.3.6 Update - SwEdition commerce
Magento ≫ Magento Version 2.3.6 Update - SwEdition open_source
Magento ≫ Magento Version 2.4.0 Update - SwEdition commerce
Magento ≫ Magento Version 2.4.0 Update - SwEdition open_source
Magento ≫ Magento Version 2.4.0 Update p1 SwEdition commerce
Magento ≫ Magento Version 2.4.0 Update p1 SwEdition open_source
Magento ≫ Magento Version 2.4.1 Update - SwEdition commerce
Magento ≫ Magento Version 2.4.1 Update - SwEdition open_source
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 1.56% 0.72
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 7.5 10 6.4
AV:N/AC:L/Au:N/C:P/I:P/A:P
Adobe 5.6 2.2 3.4
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
CWE-613 Insufficient Session Expiration

According to WASC, "Insufficient Session Expiration is when a web site permits an attacker to reuse old session credentials or session IDs for authorization."

https://helpx.adobe.com/security/products/magento/apsb21-08.html
Vendor Advisory