PT-2022-37721 · Packagist · Magento Community Edition+1

Published 2022-05-24 · Updated 2022-05-24

OSV

CVSS v3.1

7.2

High

Base vector

AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper authorization vulnerability. An attacker with admin privileges could leverage this vulnerability to achieve remote code execution.

Fix

Improper Authorization

Weakness Enumeration

CWE-285

Related Identifiers

GHSA-M8WX-WHPP-Q283

Affected Products

Magento Community Edition

Magento/Project-Community-Edition

References · 4

• https://osv.dev/vulnerability/GHSA-m8wx-whpp-q283 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-36029 · Security Note
• https://github.com/magento/magento2 · Note
• https://helpx.adobe.com/security/products/magento/apsb21-64.html · Note