CVE-2021-36022

Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability in the Widgets Update Layout. An attacker with admin privileges can trigger a specially crafted script to achieve remote code execution.
References
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:adobe:adobe_commerce:*:*:*:*:*:*:*:*
cpe:2.3:a:adobe:adobe_commerce:*:*:*:*:*:*:*:*
cpe:2.3:a:adobe:adobe_commerce:2.4.2:p1:*:*:*:*:*:*
cpe:2.3:a:adobe:magento_open_source:*:*:*:*:*:*:*:*
cpe:2.3:a:adobe:magento_open_source:*:*:*:*:*:*:*:*
cpe:2.3:a:adobe:magento_open_source:2.4.2:p1:*:*:*:*:*:*

History

No history.

Information

Published : 2021-09-01 15:15

Updated : 2024-02-28 18:28


NVD link : CVE-2021-36022

Mitre link : CVE-2021-36022

CVE.ORG link : CVE-2021-36022


JSON object : View

Products Affected

adobe

  • magento_open_source
  • adobe_commerce
CWE
CWE-91

XML Injection (aka Blind XPath Injection)

CWE-78

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')