GHSA-fvrf-9428-527m

Suggest an improvement
Source
https://github.com/advisories/GHSA-fvrf-9428-527m
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/04/GHSA-fvrf-9428-527m/GHSA-fvrf-9428-527m.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-fvrf-9428-527m
Aliases
Related
Published
2021-04-22T16:11:01Z
Modified
2026-01-30T02:27:29.916709Z
Severity
  • 9.1 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H CVSS Calculator
Summary
Backport for CVE-2021-21024 Blind SQLi from Magento 2
Details

Impact

This vulnerability allows an administrator unauthorized access to restricted resources.

We fixed a vulnerability in the MySQL adapter to prevent SQL injection attacks. This is a backport of CVE-2021-21024 https://helpx.adobe.com/security/products/magento/apsb21-08.html.

Patches

Has the problem been patched? What versions should users upgrade to?

v20.0.9 v19.4.13

Database specific 
{
    "cwe_ids": [
        "CWE-89"
    ],
    "severity": "CRITICAL",
    "nvd_published_at": "2021-04-21T21:15:00Z",
    "github_reviewed": true,
    "github_reviewed_at": "2021-04-21T21:06:43Z"
}
References

Affected packages

Packagist / openmage/magento-lts

Package

Name
openmage/magento-lts
Purl
pkg:composer/openmage/magento-lts

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
19.4.13

Affected versions

1.*
1.9.1.1
1.9.2.0
1.9.2.1
1.9.2.2
1.9.2.3
1.9.2.4
1.9.3.0
1.9.3.1
v19.*
v19.4.0
v19.4.1
v19.4.2
v19.4.3
v19.4.4
v19.4.5
v19.4.6
v19.4.7
v19.4.8
v19.4.9
v19.4.10
v19.4.11
v19.4.12

Database specific

last_known_affected_version_range 
"<= 19.4.12"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/04/GHSA-fvrf-9428-527m/GHSA-fvrf-9428-527m.json"

Packagist / openmage/magento-lts

Package

Name
openmage/magento-lts
Purl
pkg:composer/openmage/magento-lts

Affected ranges

Type
ECOSYSTEM
Events
Introduced
20.0.0
Fixed
20.0.9

Affected versions

v20.*
v20.0.0
v20.0.1
v20.0.2
v20.0.3
v20.0.4
v20.0.5
v20.0.6
v20.0.7
v20.0.8

Database specific

last_known_affected_version_range 
"<= 20.0.8"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/04/GHSA-fvrf-9428-527m/GHSA-fvrf-9428-527m.json"