Read the docs
TI-2021-04137 Aliases CVE-2021-21031GHSA-4h3p-63x6-vwg2

Magento Commerce Failure To Invalidate User Session Could Lead To Unauthorized Access

Priority LOW 29CWE-613Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
Security bypass
Confidentiality · integrity · availability
Low · Low · Low
Fix status
Fixed

Attack profile from CVSS 3.0 · CNA. Fix status from CNA and GitHub. Impact type from CWE-613.

Summary

Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) do not adequately invalidate user sessions. Successful exploitation could lead to unauthorized access to restricted resources. Access to the admin console is not required for successful exploitation.

Why it matters now

EPSS 0.01694 77th percentileScored 2026-11-07
Fix Fixed magento/community-edition (Packagist): 2.4.1-p1, 2.3.6

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
AdobeMagento.comup to 2.4.1; up to 2.4.0-p1; up to 2.3.6; up to None—No fix listedCNA
—magento/community-edition (Packagist)2.4.0 to before 2.4.1-p12.4.1-p1Patch availableGHSA-4h3p-63x6-vwg2
—magento/community-edition (Packagist)before 2.3.62.3.6Patch availableGHSA-4h3p-63x6-vwg2
—magento/project-community-edition (Packagist)up to 2.0.2—No fix listedGHSA-4h3p-63x6-vwg2
  • Magento.com VendorAdobe Affected up to 2.4.1; up to 2.4.0-p1; up to 2.3.6; up to None Fixed in — No fix listed CNA
  • magento/community-edition (Packagist) Vendor— Affected 2.4.0 to before 2.4.1-p1 Fixed in 2.4.1-p1 Patch available GHSA-4h3p-63x6-vwg2
  • magento/community-edition (Packagist) Vendor— Affected before 2.3.6 Fixed in 2.3.6 Patch available GHSA-4h3p-63x6-vwg2
  • magento/project-community-edition (Packagist) Vendor— Affected up to 2.0.2 Fixed in — No fix listed GHSA-4h3p-63x6-vwg2

CPE configurations NVD · 10

CPEVersionsRoleVendor
cpe:2.3:a:magento:magento:*:*:*:*:commerce:*:*:*before 2.3.6VulnerableMagento
cpe:2.3:a:magento:magento:*:*:*:*:open_source:*:*:*before 2.3.6VulnerableMagento
cpe:2.3:a:magento:magento:2.3.6:-:*:*:commerce:*:*:*2.3.6VulnerableMagento
cpe:2.3:a:magento:magento:2.3.6:-:*:*:open_source:*:*:*2.3.6VulnerableMagento
cpe:2.3:a:magento:magento:2.4.0:-:*:*:commerce:*:*:*2.4.0VulnerableMagento
cpe:2.3:a:magento:magento:2.4.0:-:*:*:open_source:*:*:*2.4.0VulnerableMagento
cpe:2.3:a:magento:magento:2.4.0:p1:*:*:commerce:*:*:*2.4.0 p1VulnerableMagento
cpe:2.3:a:magento:magento:2.4.0:p1:*:*:open_source:*:*:*2.4.0 p1VulnerableMagento
cpe:2.3:a:magento:magento:2.4.1:-:*:*:commerce:*:*:*2.4.1VulnerableMagento
cpe:2.3:a:magento:magento:2.4.1:-:*:*:open_source:*:*:*2.4.1VulnerableMagento
  • cpe:2.3:a:magento:magento:*:*:*:*:commerce:*:*:* Versions before 2.3.6 Vulnerable ·Magento
  • cpe:2.3:a:magento:magento:*:*:*:*:open_source:*:*:* Versions before 2.3.6 Vulnerable ·Magento
  • cpe:2.3:a:magento:magento:2.3.6:-:*:*:commerce:*:*:* Versions 2.3.6 Vulnerable ·Magento
  • cpe:2.3:a:magento:magento:2.3.6:-:*:*:open_source:*:*:* Versions 2.3.6 Vulnerable ·Magento
  • cpe:2.3:a:magento:magento:2.4.0:-:*:*:commerce:*:*:* Versions 2.4.0 Vulnerable ·Magento
  • cpe:2.3:a:magento:magento:2.4.0:-:*:*:open_source:*:*:* Versions 2.4.0 Vulnerable ·Magento
  • cpe:2.3:a:magento:magento:2.4.0:p1:*:*:commerce:*:*:* Versions 2.4.0 p1 Vulnerable ·Magento
  • cpe:2.3:a:magento:magento:2.4.0:p1:*:*:open_source:*:*:* Versions 2.4.0 p1 Vulnerable ·Magento
  • cpe:2.3:a:magento:magento:2.4.1:-:*:*:commerce:*:*:* Versions 2.4.1 Vulnerable ·Magento
  • cpe:2.3:a:magento:magento:2.4.1:-:*:*:open_source:*:*:* Versions 2.4.1 Vulnerable ·Magento

Remediation

  • Fix · GHSA-4h3p-63x6-vwg2 magento/community-edition (Packagist) Fixed in 2.4.1-p1 Advisory →
  • Fix · GHSA-4h3p-63x6-vwg2 magento/community-edition (Packagist) Fixed in 2.3.6 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-21031
  2. 2026-10-03 Alias added: GHSA-4h3p-63x6-vwg2

References

Advisory 2

Other 1

  • TI-2026-52938 Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336) KEVCVSS 3.1CRITICAL 10.0
  • TI-2026-35688 ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) KEVCVSS 3.1CRITICAL 10.0
  • TI-2025-34084 Adobe Experience Manager | Incorrect Authorization (CWE-863) KEVCVSS 3.1CRITICAL 10.0
  • TI-2024-22559 XXE can expose crypt key and other secrets granting full admin access KEVCVSS 3.1CRITICAL 9.8
  • TI-2023-19615 Analysis CVE-2023-29300 Bypass: Adobe ColdFusion Pre-Auth RCE KEVCVSS 3.1CRITICAL 9.8
  • TI-2023-13696 Adobe ColdFusion Deserialization of Untrusted Data Arbitrary code execution KEVCVSS 3.1CRITICAL 9.8
See all 8046 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences