Magento 2.4.1 Open Source Edition

Submit a proposal Propose CVE/GCVE/GHSA reference

Approved changes feed: RSS · Atom

cpe:2.3:a:magento:magento:2.4.1:-:*:*:open_source:*:*:*

part: a version: 2.4.1 update: -

VendorMagento (aa019b60-1c50-5218-ad20-1f4a9a786d94)
ProductMagento (6f0f93c5-be7a-5b05-986f-1521453ea442)
Edition*
Language*
Software editionopen_source
Target software*
Target hardware*
Other*
NotesImported from NVD CPE 2.0 feed

PURL mappings

PURLSourceLast updated
pkg:github/firegento/magento purl2cpe 2026-06-01 10:18:21.416461
pkg:magento/project-community-edition purl2cpe 2026-06-01 10:18:21.416463

Vulnerability references

IdentifiercpeApplicabilitySubmitteddb.gcve.eu detailsRationale
CVE:CVE-2021-28585 vulnerable 2026-06-08 05:31:24.605291 Magento Commerce improper input validation in customer customer webapi
MEDIUM (5.3)
Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are affected by an Improper input validation vulnerability in the New customer WebAPI.Successful exploitation could allow an attacker to send unsolicited spam e-mails.
Published: 2021-06-28T13:47:54.410Z
Updated: 2024-09-16T17:19:04.822Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-28584 vulnerable 2026-06-08 05:31:24.604092 Magento Commerce path traversal vulnerability in child theme store creation
MEDIUM (5.4)
Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are affected by a Path Traversal vulnerability when creating a store with child theme.Successful exploitation could lead to arbitrary file system write by an authenticated attacker. Access to the admin console is required for successful exploitation.
Published: 2021-06-28T13:49:14.173Z
Updated: 2024-09-16T17:43:34.490Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-28583 vulnerable 2026-06-08 05:31:24.600428 Magento Commerce insecure storage of sensitive documentation
HIGH (7.5)
Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are affected by a Violation of Secure Design Principles vulnerability in RMA PDF filename formats. Successful exploitation could allow an attacker to get unauthorized access to restricted resources.
Published: 2021-06-28T13:47:40.431Z
Updated: 2024-09-17T03:28:26.746Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-21032 vulnerable 2026-06-08 05:29:11.213370 Magento Commerce Failure To Invalidate User Session Could Lead To Unauthorized Access
MEDIUM (5.6)
Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) do not adequately invalidate user sessions. Successful exploitation of this issue could lead to unauthorized access to restricted resources. Access to the admin console is not required for successful exploitation.
Published: 2021-02-11T19:29:32.196Z
Updated: 2024-09-17T04:18:49.706Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-21031 vulnerable 2026-06-08 05:29:11.212632 Magento Commerce Failure To Invalidate User Session Could Lead To Unauthorized Access
MEDIUM (5.6)
Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) do not adequately invalidate user sessions. Successful exploitation could lead to unauthorized access to restricted resources. Access to the admin console is not required for successful exploitation.
Published: 2021-02-11T19:28:06.757Z
Updated: 2024-09-16T20:11:40.639Z
Reference links
Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-21030 vulnerable 2026-06-08 05:29:11.197617 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-21029 vulnerable 2026-06-08 05:29:11.196826 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-21027 vulnerable 2026-06-08 05:29:11.195680 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-21026 vulnerable 2026-06-08 05:29:11.194887 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-21025 vulnerable 2026-06-08 05:29:11.194271 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-21024 vulnerable 2026-06-08 05:29:11.193741 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-21023 vulnerable 2026-06-08 05:29:11.193192 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-21022 vulnerable 2026-06-08 05:29:11.192341 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-21020 vulnerable 2026-06-08 05:29:11.190790 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-21019 vulnerable 2026-06-08 05:29:11.190143 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-21018 vulnerable 2026-06-08 05:29:11.189474 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-21016 vulnerable 2026-06-08 05:29:11.181516 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-21015 vulnerable 2026-06-08 05:29:11.180873 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data
CVE:CVE-2021-21014 vulnerable 2026-06-08 05:29:11.180030 db.gcve.eu details were skipped to keep the page responsive. Imported from gcve-enriched-dumps CVE data

Contribute

You can submit an edit proposal for this CPE entry or suggest a related product/vendor addition using the action button above.