PT-2021-3432 · Adobe · Magento

Published

2021-05-11

·

Updated

2024-03-06

·

CVE-2021-28584

CVSS v2.0

6.5

Medium

VectorAV:N/AC:L/Au:S/C:P/I:P/A:P
Name of the Vulnerable Software and Affected Versions Magento versions 2.4.2 and earlier Magento versions 2.4.1-p1 and earlier Magento versions 2.3.6-p1 and earlier
Description The issue is related to incorrect restriction of the path name to a directory with limited access. Exploitation of this issue may allow a remote attacker to write arbitrary files to the device's file system. Successful exploitation requires access to the admin console and can be carried out by an authenticated attacker. The vulnerability can be exploited when creating a store with a child theme, potentially leading to arbitrary file system write.
Recommendations For Magento versions 2.4.2 and earlier, update to a version that includes a fix for this issue. For Magento versions 2.4.1-p1 and earlier, update to a version that includes a fix for this issue. For Magento versions 2.3.6-p1 and earlier, update to a version that includes a fix for this issue. As a temporary workaround, consider restricting access to the admin console to minimize the risk of exploitation.

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

BDU:2021-03284
BIT-MAGENTO-2021-28584
CVE-2021-28584
GHSA-7GPV-XRJR-F5H4

Affected Products

Magento