CRITICAL🇵🇱 Wersja polska

CVE-2021-36029

CVSS 9.1v3.1pub. 2021-09-01upd. 2024-11-21

Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper improper authorization vulnerability. An attacker with admin privileges could leverage this vulnerability to achieve remote code execution.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

  • Adobe Commerce

    APP
    Adobe
    2.4.22.3.0 – 2.3.72.4.0 – 2.4.2

  • Adobe Magento Open Source

    APP
    Adobe
    2.4.22.3.0 – 2.3.72.4.0 – 2.4.2
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
RCE
CWE
References

Related vulnerabilities

CVE-2022-24093CRITICAL9.1PL ✓same product

Adobe Commerce / Magento — RCE przez improper input validation

CVE-2022-35698CRITICAL10.0PL ✓same product

Stored XSS z możliwością RCE w Adobe Commerce i Magento Open Source

CVE-2021-36028CRITICAL9.1PL ✓same product

XML Injection w Adobe Magento Commerce umożliwiający RCE

CVE-2021-36024CRITICAL9.1PL ✓same product

Command Injection w Adobe Magento Commerce — RCE przez upload pliku

CVE-2021-36022CRITICAL9.1PL ✓same product

XML Injection w Magento Commerce — RCE przez Widgets Update Layout