GHSA-fvrf-9428-527mCriticalCVSS 9.1

Backport for CVE-2021-21024 Blind SQLi from Magento 2

Published
April 22, 2021
Last Modified
February 1, 2023

🔗 CVE IDs covered (1)

CVE-2021-21427 →

📋 Description

Impact

This vulnerability allows an administrator unauthorized access to restricted resources.

We fixed a vulnerability in the MySQL adapter to prevent SQL injection attacks. This is a backport of CVE-2021-21024 https://helpx.adobe.com/security/products/magento/apsb21-08.html.

Patches

Has the problem been patched? What versions should users upgrade to?

v20.0.9 v19.4.13

🎯 Affected products2

  • composer/openmage/magento-lts:<= 19.4.12
  • composer/openmage/magento-lts:>= 20.0.0, <= 20.0.8

🔗 References (3)