PT-2021-6286 · Adobe · Magento Commerce

Published 2021-08-11 · Updated 2022-10-27 · CVE-2021-36029

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) Magento Commerce version 2.3.7 (and earlier)

Description The issue is related to improper authorization in Magento Commerce, allowing an attacker with admin privileges to potentially achieve remote code execution. This could enable the attacker to bypass security functions and gain unauthorized access to protected information.

Recommendations For Magento Commerce versions 2.4.2 (and earlier) and 2.4.2-p1 (and earlier), update to a version that fixes the improper authorization issue. For Magento Commerce version 2.3.7 (and earlier), update to a version that fixes the improper authorization issue. As a temporary workaround, consider restricting access to admin privileges to minimize the risk of exploitation.

Fix

RCE

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

BDU:2022-01258

CVE-2021-36029

GHSA-M8WX-WHPP-Q283

Affected Products

Magento Commerce

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2021-36029 · Security Note
• https://osv.dev/vulnerability/CVE-2021-36029 · Vendor Advisory
• https://helpx.adobe.com/security/products/magento/apsb21-64.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-01258 · Security Note
• https://osv.dev/vulnerability/GHSA-m8wx-whpp-q283 · Vendor Advisory
• https://github.com/magento/magento2 · Note
• https://t.me/cibsecurity/28174 · Telegram Post