CVE-2021-21427: Backport for CVE-2021-21024 Blind SQLi from Magento 2

Severity: high (CVSS 7.2 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2021-04-21 · updated 2026-06-17
Weakness: CWE-89

Description

Magento-lts is a long-term support alternative to Magento Community Edition (CE). A vulnerability in magento-lts versions before 19.4.13 and 20.0.9 potentially allows an administrator unauthorized access to restricted resources. This is a backport of CVE-2021-21024. The vulnerability is patched in versions 19.4.13 and 20.0.9.

Affected products

OpenMage magento-lts: before 19.4.13; from 20.0.0 before 20.0.9 — fixed in 19.4.13, 20.0.9

How to fix

Upgrade to a fixed version: OpenMage magento-lts 19.4.13, 20.0.9. Check the vendor advisory for mitigations.

References

https://github.com/OpenMage/magento-lts/security/advisories/GHSA-fvrf-9428-527m
https://github.com/OpenMage/magento-lts/security/advisories/GHSA-fvrf-9428-527m

Get alerted when CVE-2021-21427 or the next vulnerability affects your stack