CVE-2021-21031CWE-613

Magento Commerce Failure To Invalidate User Session Could Lead To Unauthorized Access

Medium · published February 11, 2021

CVSS v3.0
5.6
EPSS
2%
Percentile
76.7
In the wild
Unconfirmed
What it is

Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) do not adequately invalidate user sessions. Successful exploitation could lead to unauthorized access to restricted resources. Access to the admin console is not required for successful exploitation.

The record
Technical detail
CVSS v3.0
5.6 · MEDIUM
Vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.01673 · 76.7th percentile
Weakness
CWE-613 · Insufficient Session Expiration
Published
2021-02-11T19:28Z
EPSS history
Timeline
  • 11 FEB 19:28Z
    Magento Commerce Failure To Invalidate User Session Could Lead To Unauthorized Access
    cvelistv5