PT-2023-36455 · Packagist · Magento Community Edition+1

Published 2023-09-06 · Updated 2023-09-06

OSV

CVSS v3.1

9.1

Critical

Base vector

AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Magento versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper access control vulnerability within Magento's Media Gallery Upload workflow. By storing a specially crafted file in the website gallery, an authenticated attacker with administrative privilege can gain access to delete the .htaccess file. This could result in the attacker achieving remote code execution.

Fix

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

GHSA-WQR6-WV6C-P8FX

Affected Products

Magento Community Edition

Magento/Project-Community-Edition

References · 4

• https://osv.dev/vulnerability/GHSA-wqr6-wv6c-p8fx · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-36036 · Security Note
• https://github.com/magento/magento2 · Note
• https://helpx.adobe.com/security/products/magento/apsb21-64.html · Note