PT-2022-37710 · Packagist · Magento Community Edition+1

Publicado 2022-05-24 · Atualizado 2022-05-24

OSV

CVSS v3.1

8.0

Alta

Vetor base

AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H

Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a blind SSRF vulnerability in the bundled dotmailer extension. An attacker with admin privileges could abuse this to achieve remote code execution should Redis be enabled.

Correção

SSRF

Enumeração de Fraquezas

CWE-918

Identificadores relacionados

GHSA-36XQ-7W8W-XP68

Produtos afetados

Magento Community Edition

Magento/Project-Community-Edition

Referências · 4

• https://github.com/magento/magento2 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2021-36043 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-36xq-7w8w-xp68 · Aviso do Fabricante
• https://helpx.adobe.com/security/products/magento/apsb21-64.html · Nota