PT-2021-3433 · Adobe · Magento

Published 2021-05-11 · Updated 2024-03-06 · CVE-2021-28585

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Magento versions 2.4.2 and earlier Magento versions 2.4.1-p1 and earlier Magento versions 2.3.6-p1 and earlier

Description The issue is related to improper input validation in the New customer WebAPI, which could allow an attacker to send unsolicited spam emails. Exploitation of this issue may enable a remote attacker to bypass security features in the target system using a specially crafted PDF file.

Recommendations For Magento versions 2.4.2 and earlier, update to a version that includes the fix for the improper input validation issue. For Magento versions 2.4.1-p1 and earlier, update to a version that includes the fix for the improper input validation issue. For Magento versions 2.3.6-p1 and earlier, update to a version that includes the fix for the improper input validation issue. As a temporary workaround, consider restricting access to the New customer WebAPI to minimize the risk of exploitation.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2021-03285

BIT-MAGENTO-2021-28585

CVE-2021-28585

GHSA-C38M-9668-6J2W

Affected Products

Magento

References · 8

• https://helpx.adobe.com/security/products/magento/apsb21-30.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-28585 · Security Note
• https://osv.dev/vulnerability/CVE-2021-28585 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-magento-2021-28585 · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-03285 · Security Note
• https://osv.dev/vulnerability/GHSA-c38m-9668-6j2w · Vendor Advisory
• https://github.com/magento/magento2/commit/1bd5cb8c065e44779526c0b044ce19b884707695 · Note
• https://cybersecurity-help.cz/vdb/SB2021051225 · Note