PT-2023-36453 · Packagist · Magento Community Edition+1

Publicado 2023-09-06 · Atualizado 2023-09-06

OSV

CVSS v3.1

9.1

Crítica

Vetor base

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Magento versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an Improper input validation vulnerability within the CMS page scheduled update feature. An authenticated attacker with administrative privilege could leverage this vulnerability to achieve remote code execution on the system.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

GHSA-4G27-Q2W9-M8M8

Produtos afetados

Magento Community Edition

Magento/Project-Community-Edition

Referências · 4

• https://github.com/magento/magento2 · Nota
• https://osv.dev/vulnerability/GHSA-4g27-q2w9-m8m8 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2021-36021 · Nota de Segurança
• https://helpx.adobe.com/security/products/magento/apsb21-64.html · Nota