CVE-2021-21427: 
PHP vulnerability analysis and mitigation

Magento-lts, a long-term support alternative to Magento Community Edition (CE), was found to contain a vulnerability that potentially allows an administrator unauthorized access to restricted resources. The vulnerability affects magento-lts versions before 19.4.13 and 20.0.9. This is a backport of CVE-2021-21024. The issue was disclosed in April 2021 (NVD, GitHub Advisory).

The vulnerability exists in the MySQL adapter and could potentially be exploited through SQL injection attacks. The CVSS v3.1 base score is rated as 7.2 HIGH by NVD with vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H, while GitHub rates it as 9.1 CRITICAL with vector string CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H. The vulnerability is classified under CWE-89 (Improper Neutralization of Special Elements used in an SQL Command) (NVD).

A successful exploitation of this vulnerability could allow an administrator to gain unauthorized access to restricted resources through SQL injection attacks, potentially compromising the confidentiality, integrity, and availability of the system (GitHub Advisory).

The vulnerability requires high privileges (administrator access) but low attack complexity and no user interaction for exploitation. The attack vector is network-accessible (NVD).

The vulnerability has been patched in magento-lts versions 19.4.13 and 20.0.9. Users running affected versions should upgrade to these patched versions or later to mitigate the vulnerability (GitHub Advisory).