GitHub Advisoryadvisory · Packagist

GHSA-h437-qjj9-vmq4 Magento XPath Injection

CRITICAL Published 2022-05-24 Modified 2025-02-10 Official page ↗
Aliases
CVE-2021-21025
Ecosystem
Packagist
Packages
magento/community-edition, magento/project-community-edition
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Weaknesses
CWE-91
Reviewed
2024-01-10

Affected packages

• Packagist magento/community-edition: < 2.3.6-p1 → fixed in 2.3.6-p1 • Packagist magento/community-edition: >= 2.4.0, < 2.4.1-p1 → fixed in 2.4.1-p1 • Packagist magento/project-community-edition: <= 2.0.2 (no fix yet)

Description

Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to XML injection in the product layout updates. Successful exploitation could lead to arbitrary code execution by an authenticated attacker. Access to the admin console is required for successful exploitation.

Related

Alias · CVE (1)

  • CVE-2021-21025 Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to XML injection in the product layout… vulnerability

Weakness · CWE (1)

  • CWE-91 XML Injection weakness

References