6.5

CVE-2021-21014

Magento Commerce Arbitrary Folder Empty Could Lead To Arbitrary Code Execution

Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to a file upload restriction bypass. Successful exploitation could lead to arbitrary code execution by an authenticated attacker. Access to the admin console is required for successful exploitation.
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Magento ≫ Magento SwEdition commerce Version < 2.3.6
Magento ≫ Magento SwEdition open_source Version < 2.3.6
Magento ≫ Magento Version 2.3.6 Update - SwEdition commerce
Magento ≫ Magento Version 2.3.6 Update - SwEdition open_source
Magento ≫ Magento Version 2.4.0 Update - SwEdition commerce
Magento ≫ Magento Version 2.4.0 Update - SwEdition open_source
Magento ≫ Magento Version 2.4.0 Update p1 SwEdition commerce
Magento ≫ Magento Version 2.4.0 Update p1 SwEdition open_source
Magento ≫ Magento Version 2.4.1 Update - SwEdition commerce
Magento ≫ Magento Version 2.4.1 Update - SwEdition open_source
Zu dieser CVE wurde keine Warnung gefunden.
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 4.21% 0.897
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
NIST 6.5 8 6.4
AV:N/AC:L/Au:S/C:P/I:P/A:P
Adobe 9.1 2.3 6
CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
CWE-434 Unrestricted Upload of File with Dangerous Type

The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

https://helpx.adobe.com/security/products/magento/apsb21-08.html
Vendor Advisory