by Kastro
Paper/Archive/CVE-2021-36029

CVE-2021-36029

Adobe Magento Commerce — Magento Commerce Improper Authorization Vulnerability Could Lead To Remote Code Execution

EPSS 2%CVSS 9.1
critical.is priorityof 100
44
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 84.6.846 × 2016.9No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper improper authorization vulnerability. An attacker with admin privileges could leverage this vulnerability to achieve remote code execution.

Affected

ProductAffectedFixed inSource
Magento Commerceunspecified – 2.4.2–CNA
Magento Commerceunspecified – 2.4.2-p1–CNA
Magento Commerceunspecified – 2.3.7–CNA
Magento Commerceunspecified – None–CNA

Scores by source

adobe (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

References

refhelpx.adobe.com/security/products/magento/apsb21-64.html