SQL Injection in Adobe Magento Commerce
CVE-2021-21024
Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are affected by a blind SQL injection vulnerability in the Search module. Successful exploitation could lead to unauthorized access to restricted resource…
Vulnerability class: SQL Injection
EPSS: 0.028 (84.7th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.1 (Critical). Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H.
Affected products
- Adobe Magento Commerce — versions unspecified
- Magento — versions 2.3.6, 2.4.0, 2.4.1
Weakness classification (CWE)
Public proof-of-concept exploits
References
- psirt@adobe.com (x_refsource_MISC, Vendor Advisory)
Frequently asked questions
- What is CVE-2021-21024?
- CVE-2021-21024 is a critical-severity vulnerability in Adobe Magento Commerce, classified under SQL Injection. CVSS score: 9.1/10. Published 2021-02-11.
- How severe is CVE-2021-21024?
- Critical severity. CVSS v3 base score is 9.1 out of 10.
- Is CVE-2021-21024 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.