PT-2021-2182 · Adobe · Magento

Published 2021-02-09 · Updated 2024-03-06 · CVE-2021-21014

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Magento versions 2.4.1 and earlier Magento versions 2.4.0-p1 and earlier Magento versions 2.3.6 and earlier

Description The issue is related to a file upload restriction bypass, which could lead to arbitrary code execution by an authenticated attacker. Access to the admin console is required for successful exploitation. The vulnerability is associated with unrestricted file uploads of dangerous types, allowing a remote attacker to execute arbitrary code.

Recommendations For Magento versions 2.4.1 and earlier, update to a version that includes the fix for this issue. For Magento versions 2.4.0-p1 and earlier, update to a version that includes the fix for this issue. For Magento versions 2.3.6 and earlier, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting file uploads to minimize the risk of exploitation.

Exploit

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

BDU:2021-01091

BIT-MAGENTO-2021-21014

CVE-2021-21014

GHSA-269W-PQC7-68Q9

Affected Products

Magento

References · 11

• 🔥 https://github.com/HoangKien1020/CVE-2021-21014 · Exploit
• https://osv.dev/vulnerability/BIT-magento-2021-21014 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-269w-pqc7-68q9 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-01091 · Security Note
• https://helpx.adobe.com/security/products/magento/apsb21-08.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-21014 · Security Note
• https://osv.dev/vulnerability/CVE-2021-21014 · Vendor Advisory
• https://github.com/magento/magento2 · Note
• https://github.com/magento/magento2/commit/a2eb7e29ea92a8bbc86c3b6b81b59d8533088497 · Note
• https://github.com/magento/magento2/commit/a349e022c9ae070e7da262021f9ef182105aa00b · Note
• https://t.me/cibsecurity/23496 · Telegram Post