PT-2021-19855 · Npm · Magento-Scripts

Ejnshtein · Published 2021-06-14 · Updated 2021-06-29 · CVE-2021-32684

Positive Technologies (AI Summary)

CVSS v3.1

6.2

Medium

Base vector

AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions magento-scripts versions 1.5.1 through 1.5.2

Description The issue arises from the change of a function from synchronous to asynchronous without implementing a handler in the start, stop, exec, and logs commands, making them unusable.

Recommendations For versions 1.5.1 and 1.5.2, upgrade to version 1.5.3 or the latest version using npm i @scandipwa/magento-scripts@1.5.3 or npm i @scandipwa/magento-scripts@latest.

Fix

Weakness Enumeration

CWE-670

Related Identifiers

CVE-2021-32684

GHSA-52QP-GWWH-QRG4

Affected Products

Magento-Scripts

References · 6

• https://github.com/scandipwa/create-magento-app/security/advisories/GHSA-52qp-gwwh-qrg4 · Patch
• https://github.com/scandipwa/create-magento-app/commit/89115db7031e181eb8fb4ec2822bc6cab88e7071 · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2021-32684 · Security Note
• https://osv.dev/vulnerability/CVE-2021-32684 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-52qp-gwwh-qrg4 · Vendor Advisory
• https://t.me/cvenotify/16322 · Telegram Post