PT-2023-36453 · Packagist · Magento Community Edition+1

Published 2023-09-06 · Updated 2023-09-06

OSV

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Magento versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an Improper input validation vulnerability within the CMS page scheduled update feature. An authenticated attacker with administrative privilege could leverage this vulnerability to achieve remote code execution on the system.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

GHSA-4G27-Q2W9-M8M8

Affected Products

Magento Community Edition

Magento/Project-Community-Edition

References · 4

• https://osv.dev/vulnerability/GHSA-4g27-q2w9-m8m8 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-36021 · Security Note
• https://github.com/magento/magento2 · Note
• https://helpx.adobe.com/security/products/magento/apsb21-64.html · Note