PT-2022-37716 · Packagist · Magento Community Edition+1

Published 2022-05-24 · Updated 2022-05-24

OSV

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability in the API File Option Upload Extension. An attacker with Admin privileges can achieve unrestricted file upload which can result in remote code execution.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

GHSA-6CWV-WJ7V-73XP

Affected Products

Magento Community Edition

Magento/Project-Community-Edition

References · 4

• https://osv.dev/vulnerability/GHSA-6cwv-wj7v-73xp · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-36042 · Security Note
• https://github.com/magento/magento2 · Note
• https://helpx.adobe.com/security/products/magento/apsb21-64.html · Note