PT-2021-2188 · Adobe · Magento

Published

2021-02-09

·

Updated

2024-03-06

·

CVE-2021-21016

CVSS v3.1

9.1

Critical

VectorAV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions: Magento versions 2.4.1 and earlier Magento versions 2.4.0-p1 and earlier Magento versions 2.3.6 and earlier
Description: The issue is related to OS command injection via the WebAPI, which could lead to remote code execution by an authenticated attacker. Access to the admin console is required for successful exploitation. The vulnerability is associated with the failure to neutralize special elements used in the operating system command.
Recommendations: For Magento versions 2.4.1 and earlier, update to a version that fixes the OS command injection issue. For Magento versions 2.4.0-p1 and earlier, update to a version that fixes the OS command injection issue. For Magento versions 2.3.6 and earlier, update to a version that fixes the OS command injection issue. As a temporary workaround, consider restricting access to the WebAPI to minimize the risk of exploitation.

Fix

RCE

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2021-01097
BIT-MAGENTO-2021-21016
CVE-2021-21016
GHSA-792F-C8MP-2CR5

Affected Products

Magento