by Kastro
Paper/Archive/CVE-2021-36042

CVE-2021-36042

Adobe Magento Commerce — Magento Commerce API File Option Upload Extension Improper Input Validation Vulnerability Could Lead To Remote Code Execution

EPSS 2%CVSS 9.1
critical.is priorityof 100
44
CVSS 9.1 (CNA)9.1 / 10 × 3027.3Not in CISA KEV+300.0EPSS percentile 84.5.845 × 2016.9No public exploit+100.0SSVC exploitation: unknown+100.0
Description · from the CVE record

Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability in the API File Option Upload Extension. An attacker with Admin privileges can achieve unrestricted file upload which can result in remote code execution.

Affected

ProductAffectedFixed inSource
Magento Commerceunspecified – 2.4.2–CNA
Magento Commerceunspecified – 2.4.2-p1–CNA
Magento Commerceunspecified – 2.3.7–CNA
Magento Commerceunspecified – None–CNA

Scores by source

adobe (CNA)9.1CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

References

refhelpx.adobe.com/security/products/magento/apsb21-64.html