PT-2021-2183 · Adobe · Magento
Published
2021-02-09
·
Updated
2024-03-06
·
CVE-2021-21015
CVSS v2.0
8.5
High
| Vector | AV:N/AC:M/Au:S/C:C/I:C/A:C |
Name of the Vulnerable Software and Affected Versions
Magento versions 2.4.1 and earlier
Magento versions 2.4.0-p1 and earlier
Magento versions 2.3.6 and earlier
Description
The issue is related to an OS command injection via the customer attribute save controller. Successful exploitation could lead to arbitrary code execution by an authenticated attacker. Access to the admin console is required for successful exploitation. The vulnerability is due to the lack of measures to neutralize special elements used in the OS command.
Recommendations
For Magento versions 2.4.1 and earlier, update to a version that includes the fix for this issue.
For Magento versions 2.4.0-p1 and earlier, update to a version that includes the fix for this issue.
For Magento versions 2.3.6 and earlier, update to a version that includes the fix for this issue.
As a temporary workaround, consider restricting access to the customer attribute save controller to minimize the risk of exploitation.
Fix
OS Command Injection
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Magento