CVE-2021-21032CWE-613

Magento Commerce Failure To Invalidate User Session Could Lead To Unauthorized Access

Medium · published February 11, 2021

CVSS v3.0
5.6
EPSS
2%
Percentile
75.0
In the wild
Unconfirmed
What it is

Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) do not adequately invalidate user sessions. Successful exploitation of this issue could lead to unauthorized access to restricted resources. Access to the admin console is not required for successful exploitation.

The record
Technical detail
CVSS v3.0
5.6 · MEDIUM
Vector
CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.01558 · 75.0th percentile
Weakness
CWE-613 · Insufficient Session Expiration
Published
2021-02-11T19:29Z
EPSS history
Timeline
  • 11 FEB 19:29Z
    Magento Commerce Failure To Invalidate User Session Could Lead To Unauthorized Access
    cvelistv5