GHSA-6cwv-wj7v-73xp

ghsaUSosv

Magento executes code via the API File Option Upload Extension

view advisory published 2022-05-24Licence: CC-BY-4.0

Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability in the API File Option Upload Extension. An attacker with Admin privileges can achieve unrestricted file upload which can result in remote code execution.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2021-36042US	high7.2	2.47% (84th)	—	2021-09-01
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability in the API File Option Uplo…

references

External citations — patches, advisories, analysis.

https://github.com/magento/magento2PACKAGE
https://helpx.adobe.com/security/products/magento/apsb21-64.htmlWEB
https://nvd.nist.gov/vuln/detail/CVE-2021-36042ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan