GitHub Advisoryadvisory · Packagist

GHSA-rv48-v862-mp92 Magento OS Command Injection

CRITICAL Published 2022-05-24 Modified 2024-01-10 Official page ↗
Aliases
CVE-2021-21018
Ecosystem
Packagist
Packages
magento/community-edition
Severity
Critical
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
Weaknesses
CWE-78
Reviewed
2024-01-10

Affected packages

• Packagist magento/community-edition: < 2.3.6 → fixed in 2.3.6 • Packagist magento/community-edition: >= 2.4.0, < 2.4.1-p1 → fixed in 2.4.1-p1

Description

Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to OS command injection via the scheduled operation module. Successful exploitation could lead to arbitrary code execution by an authenticated attacker. Access to the admin console is required for successful exploitation.

Related

Alias · CVE (1)

  • CVE-2021-21018 Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to OS command injection via the… vulnerability

Weakness · CWE (1)

  • CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness

References