Magento Update Released to Fix Critical Flaws Affecting E
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2021-36020 | Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability in the 'City' field. Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability in the 'City' field. An unauthenticated attacker can trigger a specially crafted script to achieve remote code execution. NVD description · AI analysis pending | 9.8 group max | 3% |
| — | ||
| CVE-2021-36023 | Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability in the Widgets Upda Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability in the Widgets Update Layout. An attacker with admin privileges can trigger a specially crafted script to achieve remote code execution. NVD description · AI analysis pending | 7.2 | 2% |
| — |
Full article323 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananAug 11, 2021
Adobe on Tuesday shipped security updates to remediate multiple critical vulnerabilities in its Magento e-commerce platform that could be abused by an attacker to execute arbitrary code and take control of a vulnerable system.
The issues affect 2.3.7, 2.4.2-p1, 2.4.2, and earlier versions of Magento Commerce, and 2.3.7, 2.4.2-p1, and all prior versions of Magento Open Source edition. Of the 26 flaws addressed, 20 are rated critical, and six are rated Important in severity. None of the vulnerabilities fixed this month by Adobe are listed as publicly known or under active attack at the time of release.
The most concerning of the bugs are as follows -
- CVE-2021-36021, CVE-2021-36024, CVE-2021-36025, CVE-2021-36034, CVE-2021-36035, CVE-2021-36040, CVE-2021-36041, and CVE-2021-36042 (CVSS score: 9.1) - Arbitrary code execution due to improper input validation
- CVE-2021-36022 and CVE-2021-36023 (CVSS score: 9.1) - Arbitrary code execution due to OS command injection
- CVE-2021-36028 and CVE-2021-36033 (CVSS score: 9.1) - Arbitrary code execution due to XML injection
- CVE-2021-36036 (CVSS score: 9.1) - Arbitrary code execution due to improper access control
- CVE-2021-36029 (CVSS score: 9.1) - Security feature bypass
- CVE-2021-36032 (CVSS score: 8.3) - Privilege escalation
- CVE-2021-36020 (CVSS score: 8.2) - Arbitrary code execution due to XML injection
- CVE-2021-36043 (CVSS score: 8.0) - Arbitrary code execution due to server-side request forgery (SSRF)
- CVE-2021-36044 (CVSS score: 7.5) - Application denial-of-service
- CVE-2021-36030 (CVSS score: 7.5) - Security feature bypass
- CVE-2021-36031 (CVSS score: 7.2) - Arbitrary code execution due to path traversal
Successful exploitation of the aforementioned pre-authentication vulnerabilities could be abused by an adversary to escalate privileges and run malicious code, thus enabling the threat actor to seize control of a Magento site and its server.
Users are highly advised to move quickly to download the appropriate patches and install them to mitigate the risks associated with the flaws.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2021/08/magento-update-released-fix-critical.html