Magento 2.4.0 Patch 1 Open Source Edition
Approved changes feed: RSS · Atom
cpe:2.3:a:magento:magento:2.4.0:p1:*:*:open_source:*:*:*
part: a version: 2.4.0 update: p1
| Vendor | Magento (aa019b60-1c50-5218-ad20-1f4a9a786d94) |
|---|---|
| Product | Magento (6f0f93c5-be7a-5b05-986f-1521453ea442) |
| Edition | * |
| Language | * |
| Software edition | open_source |
| Target software | * |
| Target hardware | * |
| Other | * |
| Notes | Imported from NVD CPE 2.0 feed |
PURL mappings
| PURL | Source | Last updated |
|---|---|---|
pkg:github/firegento/magento |
purl2cpe | 2026-06-01 10:18:21.416447 |
pkg:magento/project-community-edition |
purl2cpe | 2026-06-01 10:18:21.416449 |
Vulnerability references
| Identifier | cpeApplicability | Submitted | db.gcve.eu details | Rationale |
|---|---|---|---|---|
CVE:CVE-2021-21032 |
vulnerable | 2026-06-08 05:29:11.213336 |
Magento Commerce Failure To Invalidate User Session Could Lead To Unauthorized Access
MEDIUM (5.6)
Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) do not adequately invalidate user sessions. Successful exploitation of this issue could lead to unauthorized access to restricted resources. Access to the admin console is not required for successful exploitation.
Published: 2021-02-11T19:29:32.196Z
Updated: 2024-09-17T04:18:49.706Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-21031 |
vulnerable | 2026-06-08 05:29:11.212598 |
Magento Commerce Failure To Invalidate User Session Could Lead To Unauthorized Access
MEDIUM (5.6)
Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) do not adequately invalidate user sessions. Successful exploitation could lead to unauthorized access to restricted resources. Access to the admin console is not required for successful exploitation.
Published: 2021-02-11T19:28:06.757Z
Updated: 2024-09-16T20:11:40.639Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-21030 |
vulnerable | 2026-06-08 05:29:11.197583 |
Magento Commerce Stored Cross-site Scripting Could Lead To Arbitrary Javascript Execution
HIGH (8.1)
Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to a stored cross-site scripting (XSS) in the customer address upload feature. Successful exploitation could lead to arbitrary JavaScript execution in the victim's browser. Exploitation of this issue requires user interaction.
Published: 2021-02-11T19:29:31.185Z
Updated: 2024-09-16T19:19:56.211Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-21029 |
vulnerable | 2026-06-08 05:29:11.196793 |
Magento Commerce Reflected Cross-site Scripting Vulnerability Could Lead To Arbitrary JavaScript Execution
MEDIUM (4.8)
Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are affected by a Reflected Cross-site Scripting vulnerability via 'file' parameter. Successful exploitation could lead to arbitrary JavaScript execution in the victim's browser. Access to the admin console is required for successful exploitation.
Published: 2021-02-11T19:29:32.089Z
Updated: 2024-09-16T22:20:24.583Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-21027 |
vulnerable | 2026-06-08 05:29:11.195559 |
Magento Commerce Cross-Site Request Forgery (CSRF) Could Lead To Unauthorized Data Modification
MEDIUM (4.3)
Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are affected by a cross-site request forgery (CSRF) vulnerability via the GraphQL API. Successful exploitation could lead to unauthorized modification of customer metadata by an unauthenticated attacker. Access to the admin console is not required for successful exploitation.
Published: 2021-02-11T19:29:31.042Z
Updated: 2024-09-17T03:48:43.178Z Reference links |
Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-21026 |
vulnerable | 2026-06-08 05:29:11.194853 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-21025 |
vulnerable | 2026-06-08 05:29:11.194238 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-21024 |
vulnerable | 2026-06-08 05:29:11.193707 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-21023 |
vulnerable | 2026-06-08 05:29:11.193057 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-21022 |
vulnerable | 2026-06-08 05:29:11.192307 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-21020 |
vulnerable | 2026-06-08 05:29:11.190756 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-21019 |
vulnerable | 2026-06-08 05:29:11.190111 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-21018 |
vulnerable | 2026-06-08 05:29:11.189441 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-21016 |
vulnerable | 2026-06-08 05:29:11.181484 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-21015 |
vulnerable | 2026-06-08 05:29:11.180838 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
CVE:CVE-2021-21014 |
vulnerable | 2026-06-08 05:29:11.178782 | db.gcve.eu details were skipped to keep the page responsive. | Imported from gcve-enriched-dumps CVE data |
Contribute
You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.