GitHub Advisoryadvisory · Packagist

GHSA-mw95-gmw4-883p Magento XML injection in the Widgets module

CRITICAL Published 2022-05-24 Modified 2024-01-10 Official page ↗
Aliases
CVE-2021-21019
Ecosystem
Packagist
Packages
magento/community-edition
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Weaknesses
CWE-91
Reviewed
2024-01-10

Affected packages

• Packagist magento/community-edition: < 2.3.6-p1 → fixed in 2.3.6-p1 • Packagist magento/community-edition: >= 2.4.0, < 2.4.1-p1 → fixed in 2.4.1-p1

Description

Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to XML injection in the Widgets module. Successful exploitation could lead to arbitrary code execution by an authenticated attacker. Access to the admin console is required for successful exploitation.

Related

Alias · CVE (1)

  • CVE-2021-21019 Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to XML injection in the Widgets module. vulnerability

Weakness · CWE (1)

  • CWE-91 XML Injection weakness

References