CVE-2021-21426

Published: Apr 21, 2021Modified: Jun 17, 2026

9.8

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Exploitability: 3.9 / Impact: 5.9

Source: NVD

Description

Magento-lts is a long-term support alternative to Magento Community Edition (CE). In magento-lts versions 19.4.12 and prior and 20.0.8 and prior, there is a vulnerability caused by the unsecured deserialization of an object. A patch in versions 19.4.13 and 20.0.9 was back ported from Zend Framework 3. The vulnerability was assigned CVE-2021-3007 in Zend Framework.

Affected (2)

Products: Openmage: Magento

1 product

Configuration A

2 vulnerable

Vulnerable Software	Affected Versions
Openmage Magento	Before 19.4.13
Openmage Magento	From 20.0.0 to 20.0.9

Related CWEs

Deserialization of Untrusted Data

The product deserializes untrusted data without sufficiently verifying that the resulting data will be valid.

References (2)

https://github.com/OpenMage/magento-lts/security/advisories/GHSA-m496-x567-f98c

Source: security-advisories@github.com

Third Party Advisory

https://github.com/OpenMage/magento-lts/security/advisories/GHSA-m496-x567-f98c

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.