CVE-2021-21031— Magento Commerce Failure To Invalidate User Session Could Lead To Unauthorized Access
Quick assessment
Affected
Adobe Magento.com
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
Magento Commerce 和 Magento Open Source editions 中存在安全漏洞，该漏洞源于网络系统或产品的代码开发过程中存在设计或实现不当的问题。成功利用此漏洞可能导致执行任意代码。
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2021-21031
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Magento Commerce Failure To Invalidate User Session Could Lead To Unauthorized Access
Source: CVE Program / CVE List V5
Vulnerability Description
Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) do not adequately invalidate user sessions. Successful exploitation could lead to unauthorized access to restricted resources. Access to the admin console is not required for successful exploitation.
Source: CVE Program / CVE List V5
CVSS Information
N/A
Source: CVE Program / CVE List V5
Vulnerability Type
不充分的会话过期机制
Source: CVE Program / CVE List V5
Vulnerability Title
Magento Commerce 和 Magento Open Source editions 代码问题漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Magento Commerce 和 Magento Open Source editions 中存在安全漏洞，该漏洞源于网络系统或产品的代码开发过程中存在设计或实现不当的问题。成功利用此漏洞可能导致执行任意代码。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Adobe | Magento.com | unspecified ~ 2.4.1 | - |
|
II. Public POCs for CVE-2021-21031
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2021-21031
请登录查看更多情报信息。
Vendor Advisories for CVE-2021-21031 (1)
-
https://helpx.adobe.com/security/products/magento/apsb21-08.html x_refsource_MISC
Same Patch Batch · Adobe · 2021-02-11 · 48 CVEs total
| CVE-2021-21017 | 8.8 HIGH | Acrobat Reader DC Heap-based Buffer Overflow Vulnerability Could Lead To Arbitrary Code Ex |
| CVE-2021-21045 | 8.2 HIGH | Acrobat Reader DC Improper Installer Access Control Vulnerability Could Lead To Privilege |
| CVE-2021-21040 | 7.8 HIGH | Acrobat Reader DC Use-After-Free Vulnerability Could Lead To Arbitrary Code Execution |
| CVE-2021-21038 | 7.8 HIGH | Acrobat Reader DC Out-Of-Bounds Write Vulnerability Could Lead To Arbitrary Code Execution |
| CVE-2021-21037 | 7.8 HIGH | Acrobat Reader DC Path Traversal Vulnerability Could Lead To Arbitrary Code Execution |
| CVE-2021-21036 | 7.8 HIGH | Acrobat Reader DC Integer Overflow Vulnerability Could Lead To Arbitrary Code Execution |
| CVE-2021-21039 | 7.8 HIGH | Acrobat Reader DC Use-After-Free Vulnerability Could Lead To Arbitrary Code Execution |
| CVE-2021-21041 | 7.8 HIGH | Acrobat Reader DC Use-After-Free Vulnerability Could Lead To Arbitrary Code Execution |
| CVE-2021-21057 | 6.6 MEDIUM | Acrobat Reader DC Invalid Memory Read Due To An Uninitialized Pointer |
| CVE-2021-21055 | 6.2 MEDIUM | Adobe Dreamweaver Untrusted Search Path Vulnerability Could Lead To Information Disclosure |
| CVE-2021-21029 | 4.8 MEDIUM | Magento Commerce Reflected Cross-site Scripting Vulnerability Could Lead To Arbitrary Java |
| CVE-2021-21060 | 4.6 MEDIUM | Acrobat Pro DC Improper File Parsing Could Lead to Information Disclosure |
| CVE-2021-21053 | Adobe Illustrator Out-Of-Bounds Write Vulnerability Could Lead To Remote Code Execution | |
| CVE-2021-21062 | Acrobat Reader DC Buffer Overflow Vulnerability Could Lead To Arbitrary Code Execution | |
| CVE-2021-21048 | Adobe Photoshop Buffer Overflow Vulnerability Could Lead To Remote Code Execution Vulnerab | |
| CVE-2021-21052 | Adobe Animate Out-of-Bounds Write Vulnerability Could Lead To Arbitrary Code Execution | |
| CVE-2021-21049 | Adobe Photoshop Out-Of-Bounds Read Vulnerability Could Lead To Remote Code Execution Vulne | |
| CVE-2021-21054 | Adobe Illustrator Out-Of-Bounds Write Vulnerability Could Lead To Remote Code Execution Vu | |
| CVE-2021-21058 | Acrobat Reader DC Memory Corruption Vulnerability Could Lead to Arbitrary Code Execution | |
| CVE-2021-21034 | Acrobat Reader DC Out-Of-Bounds Read Information Disclosure Vulnerability |
Showing top 20 of 48 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same vendor: Adobe
-
CVE-2026-84397
Adobe Experience Manager | Cross-site Scripting (Stored XSS) -
CVE-2026-81984
Acrobat Reader | Use After Free (CWE-416) -
CVE-2026-81989
Acrobat Reader | Use After Free (CWE-416) -
CVE-2026-81991
Acrobat Reader | Out-of-bounds Read (CWE-125) -
CVE-2026-81980
Acrobat Reader | Out-of-bounds Write (CWE-787)
Same weakness: CWE-613
-
CVE-2026-92976
Stored Cross-Site Scripting (XSS) in T-Systems’ TAO 2.0 -
CVE-2026-86533
Revoked session accepted because the session jti is never ch -
CVE-2026-81637
Replayable OAuth2 CSRF state retained after a failed callbac -
CVE-2026-92920
admin3 through 3.0.0 Session Not Invalidated When a User Acc -
CVE-2026-92800
Docs before 5.4.1 Stale Collaboration Session After Access R
V. Comments for CVE-2021-21031
No comments yet