PT-2021-6289 · Adobe · Magento Commerce

Published 2021-08-11 · Updated 2022-05-24 · CVE-2021-36038

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Magento Commerce versions 2.4.2 and earlier Magento Commerce versions 2.4.2-p1 and earlier Magento Commerce versions 2.3.7 and earlier

Description The issue exists due to insufficient input validation in the Magento Commerce platform, allowing a remote attacker to bypass existing security restrictions. An authenticated attacker could exploit this vulnerability to disclose sensitive information, specifically through the Multishipping Module.

Recommendations For Magento Commerce versions 2.4.2 and earlier, update to a version that includes proper input validation to prevent exploitation. For Magento Commerce versions 2.4.2-p1 and earlier, update to a version that includes proper input validation to prevent exploitation. For Magento Commerce versions 2.3.7 and earlier, update to a version that includes proper input validation to prevent exploitation.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2022-01261

CVE-2021-36038

GHSA-WGPR-9675-8R67

Affected Products

Magento Commerce

References · 6

• https://osv.dev/vulnerability/CVE-2021-36038 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-36038 · Security Note
• https://bdu.fstec.ru/vul/2022-01261 · Security Note
• https://osv.dev/vulnerability/GHSA-wgpr-9675-8r67 · Vendor Advisory
• https://helpx.adobe.com/security/products/magento/apsb21-64.html · Vendor Advisory
• https://github.com/magento/magento2 · Note