PT-2021-6352 · Adobe · Magento Commerce

Published 2021-08-11 · Updated 2022-10-24 · CVE-2021-36022

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) Magento Commerce version 2.3.7 (and earlier)

Description The issue is related to an XML Injection vulnerability in the Widgets Update Layout of Magento Commerce. This vulnerability can be exploited by an attacker with admin privileges to trigger a specially crafted script, potentially achieving remote code execution. The vulnerability is also related to the lack of measures to neutralize special elements used in the operating system command.

Recommendations For Magento Commerce versions 2.4.2 (and earlier) and 2.4.2-p1 (and earlier), update to a version that fixes the XML Injection vulnerability in the Widgets Update Layout. For Magento Commerce version 2.3.7 (and earlier), update to a version that fixes the XML Injection vulnerability in the Widgets Update Layout. As a temporary workaround, consider restricting access to the Widgets Update Layout to minimize the risk of exploitation.

Fix

RCE

Special Elements Injection

OS Command Injection

Weakness Enumeration

CWE-91

CWE-74

CWE-78

Related Identifiers

BDU:2022-01371

CVE-2021-36022

GHSA-3X9X-VHQJ-CV27

Affected Products

Magento Commerce

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2021-36022 · Security Note
• https://helpx.adobe.com/security/products/magento/apsb21-64.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-36022 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-3x9x-vhqj-cv27 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-01371 · Security Note
• https://github.com/magento/magento2 · Note
• https://t.me/cvenotify/20504 · Telegram Post