CVE-2021-21427
Backport for CVE-2021-21024 Blind SQLi from Magento 2
Magento-lts is a long-term support alternative to Magento Community Edition (CE). A vulnerability in magento-lts versions before 19.4.13 and 20.0.9 potentially allows an administrator unauthorized access to restricted resources. This is a backport of CVE-2021-21024. The vulnerability is patched in versions 19.4.13 and 20.0.9.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Exploit likelihood
What each source reports
CVE List Score used
Backport for CVE-2021-21024 Blind SQLi from Magento 2
Magento-lts is a long-term support alternative to Magento Community Edition (CE). A vulnerability in magento-lts versions before 19.4.13 and 20.0.9 potentially allows an administrator unauthorized access to restricted resources. This is a backport of CVE-2021-21024. The vulnerability is patched in versions 19.4.13 and 20.0.9.
- Record
CVE-2021-21427- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-89
- Updated
- 2026-11-02
EUVDEUVD-2021-0819
Magento-lts is a long-term support alternative to Magento Community Edition (CE). A vulnerability in magento-lts versions before 19.4.13 and 20.0.9 potentially allows an administrator unauthorized access to restricted resources. This is a backport of CVE-2021-21024. The vulnerability is patched in versions 19.4.13 and 20.0.9.
- Record
EUVD-2021-0819- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-fvrf-9428-527m
Backport for CVE-2021-21024 Blind SQLi from Magento 2
Impact
This vulnerability allows an administrator unauthorized access to restricted resources.
We fixed a vulnerability in the MySQL adapter to prevent SQL injection attacks. This is a backport of CVE-2021-21024 https://helpx.adobe.com/security/products/magento/apsb21-08.html.
Patches
Has the problem been patched? What versions should users upgrade to?
v20.0.9 v19.4.13
- Record
GHSA-fvrf-9428-527m- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-89
- Updated
- 2026-11-02
NVD
Magento-lts is a long-term support alternative to Magento Community Edition (CE). A vulnerability in magento-lts versions before 19.4.13 and 20.0.9 potentially allows an administrator unauthorized access to restricted resources. This is a backport of CVE-2021-21024. The vulnerability is patched in versions 19.4.13 and 20.0.9.
- Record
CVE-2021-21427- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H - CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - CVSS 2.0
- 6.5 Medium
AV:N/AC:L/Au:S/C:P/I:P/A:P - Weakness
- CWE-89
- Updated
- 2026-11-02
OSV
Magento-lts is a long-term support alternative to Magento Community Edition (CE). A vulnerability in magento-lts versions before 19.4.13 and 20.0.9 potentially allows an administrator unauthorized access to restricted resources. This is a backport of CVE-2021-21024. The vulnerability is patched in versions 19.4.13 and 20.0.9.
- Record
CVE-2021-21427- CVSS 3.1
- 7.2 High
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-fvrf-9428-527m
Backport for CVE-2021-21024 Blind SQLi from Magento 2
Impact
This vulnerability allows an administrator unauthorized access to restricted resources.
We fixed a vulnerability in the MySQL adapter to prevent SQL injection attacks. This is a backport of CVE-2021-21024 https://helpx.adobe.com/security/products/magento/apsb21-08.html.
Patches
Has the problem been patched? What versions should users upgrade to?
v20.0.9 v19.4.13
- Record
GHSA-fvrf-9428-527m- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H - Weakness
- CWE-89
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
openmage/magento-ltsPackagist |
through 19.4.12 | 19.4.13 |
openmage/magento-ltsPackagist |
20.0.0 to 20.0.8 | 20.0.9 |
openmage/magento-ltsPackagist |
before 19.4.13, plus listed versions 1.9.1.11.9.2.01.9.2.11.9.2.21.9.2.3 Show 16 moreShow less1.9.2.41.9.3.01.9.3.1v19.4.0v19.4.1v19.4.10v19.4.11v19.4.12v19.4.2v19.4.3v19.4.4v19.4.5v19.4.6v19.4.7v19.4.8v19.4.9 |
19.4.13 |
openmage/magento-ltsPackagist |
20.0.0 up to 20.0.9, plus listed versions v20.0.0v20.0.1v20.0.2v20.0.3v20.0.4 Show 4 moreShow lessv20.0.5v20.0.6v20.0.7v20.0.8 |
20.0.9 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-21427 is a critical vulnerability (CVSS 9.1) in Openmage Magento, published April 21, 2021. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.07%, the 65th percentile. Fixed in openmage/magento-lts 19.4.13.