CVE-2021-21426

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2021-21426
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-21426.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2021-21426
Aliases
Published
2021-04-21T21:15:07.960Z
Modified
2026-08-07T11:31:29.855810356Z
Severity
  • 9.8 (Critical) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H CVSS Calculator
Summary
[none]
Details

Magento-lts is a long-term support alternative to Magento Community Edition (CE). In magento-lts versions 19.4.12 and prior and 20.0.8 and prior, there is a vulnerability caused by the unsecured deserialization of an object. A patch in versions 19.4.13 and 20.0.9 was back ported from Zend Framework 3. The vulnerability was assigned CVE-2021-3007 in Zend Framework.

Database specific 
{
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "introduced": "20.0.0"
                },
                {
                    "fixed": "20.0.9"
                },
                {
                    "introduced": "20.0.0"
                },
                {
                    "fixed": "20.0.9"
                }
            ],
            "source": "CPE_RANGE",
            "vendor_product": "openmage:magento",
            "cpes": [
                "cpe:2.3:a:openmage:magento:*:*:*:*:lts:*:*:*"
            ]
        }
    ]
}
References

Affected packages

Git / github.com/openmage/magento-lts

Affected ranges

Type
GIT
Repo
https://github.com/openmage/magento-lts
Events
Introduced
0 Unknown introduced commit / All previous commits are affected
Fixed
f71321b37a782bd167ef56de0c6e18e67645685d
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "0"
        },
        {
            "fixed": "19.4.13"
        }
    ],
    "source": "CPE_RANGE",
    "cpe": "cpe:2.3:a:openmage:magento:*:*:*:*:lts:*:*:*"
}

Affected versions

1.*
1.1.1
1.1.2
1.1.3
1.1.4
1.1.5
1.1.6
1.1.7
1.1.8
1.2.0
1.2.0.1
1.2.0.2
1.2.0.3
1.2.1
1.2.1.2
1.3.0
1.3.1
1.3.1.1
1.3.2
1.3.2.1
1.3.2.2
1.3.2.3
1.3.2.4
1.4.0.0
1.4.0.0-alpha1
1.4.0.0-alpha2
1.4.0.0-alpha3
1.4.0.0-beta1
1.4.0.0-rc1
1.4.0.1
1.4.1.0
1.4.1.1
1.4.2.0
1.5.0.0
1.5.0.0-alpha1
1.5.0.0-alpha2
1.5.0.0-beta1
1.5.0.0-beta2
1.5.0.0-rc1
1.5.0.0-rc2
1.5.0.1
1.5.1.0
1.6.0.0
1.6.0.0-alpha1
1.6.0.0-beta1
1.6.0.0-rc1
1.6.0.0-rc2
1.6.1.0
1.7.0.0
1.7.0.1
1.7.0.2
1.8.1.0
1.9.0.0
1.9.0.1
1.9.1.0-lts
1.9.1.1
v19.*
v19.4.0
v19.4.1
v19.4.10
v19.4.11
v19.4.12
v19.4.2
v19.4.3
v19.4.4
v19.4.5
v19.4.6
v19.4.7
v19.4.8
v19.4.9

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2021-21426.json"