CVE-2021-21427: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

April 22, 2021 (updated April 30, 2021)

Magento-lts is a long-term support alternative to Magento Community Edition (CE). A vulnerability in magento-lts versions before 19.4.13 and 20.0.9 potentially allows an administrator unauthorized access to restricted resources. This is a backport of CVE-2021-21024. The vulnerability is patched in versions 19.4.13 and 20.0.9.

References

github.com/OpenMage/magento-lts/security/advisories/GHSA-fvrf-9428-527m
github.com/advisories/GHSA-fvrf-9428-527m
nvd.nist.gov/vuln/detail/CVE-2021-21427

Code Behaviors & Features

Detect and mitigate CVE-2021-21427 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →