PT-2021-2959 · Adobe · Magento

Published 2021-02-09 · Updated 2024-03-06 · CVE-2021-21023

Positive Technologies (AI Summary)

CVSS v2.0

4.9

Medium

Base vector

AV:N/AC:M/Au:S/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Magento versions 2.4.1 and earlier Magento versions 2.4.0-p1 and earlier Magento versions 2.3.6 and earlier

Description The issue is related to a stored cross-site scripting vulnerability in the admin console of Magento. Successful exploitation could lead to arbitrary JavaScript execution in the victim's browser. Access to the admin console is required for successful exploitation. The vulnerability is associated with a lack of protection of the web page structure, allowing a remote attacker to execute arbitrary JavaScript code in the user's browser using administrator access to the console.

Recommendations For Magento versions 2.4.1 and earlier, update to a version that includes a fix for this vulnerability. For Magento versions 2.4.0-p1 and earlier, update to a version that includes a fix for this vulnerability. For Magento versions 2.3.6 and earlier, update to a version that includes a fix for this vulnerability. As a temporary workaround, consider restricting access to the admin console to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2021-02546

BIT-MAGENTO-2021-21023

CVE-2021-21023

GHSA-H5RM-M772-6QCX

Affected Products

Magento

References · 9

• https://helpx.adobe.com/security/products/magento/apsb21-08.html · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-h5rm-m772-6qcx · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-21023 · Security Note
• https://bdu.fstec.ru/vul/2021-02546 · Security Note
• https://osv.dev/vulnerability/BIT-magento-2021-21023 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-21023 · Vendor Advisory
• https://github.com/magento/magento2 · Note
• https://t.me/cvenotify/9808 · Telegram Post
• https://t.me/cibsecurity/23479 · Telegram Post