GHSA-4h3p-63x6-vwg2
Magento Insufficient Session Expiration
Packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| Packagist | magento/community-edition | >= 2.4.0, < 2.4.1-p1 | 2.4.1-p1 |
| Packagist | magento/community-edition | < 2.3.6 | 2.3.6 |
| Packagist | magento/project-community-edition | <= 2.0.2 | no fix listed |
Details
As written in the advisory (Markdown source, shown as plain text).
Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) do not adequately invalidate user sessions. Successful exploitation could lead to unauthorized access to restricted resources. Access to the admin console is not required for successful exploitation.
References
External links from the advisory. They lead to third-party sites.