PT-2022-37716 · Packagist · Magento Community Edition+1

Publicado 2022-05-24 · Atualizado 2022-05-24

OSV

CVSS v3.1

9.1

Crítica

Vetor base

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability in the API File Option Upload Extension. An attacker with Admin privileges can achieve unrestricted file upload which can result in remote code execution.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

GHSA-6CWV-WJ7V-73XP

Produtos afetados

Magento Community Edition

Magento/Project-Community-Edition

Referências · 4

• https://github.com/magento/magento2 · Nota
• https://osv.dev/vulnerability/GHSA-6cwv-wj7v-73xp · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2021-36042 · Nota de Segurança
• https://helpx.adobe.com/security/products/magento/apsb21-64.html · Nota