CVE-2021-36021

Magento versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an Improper input validation vulnerability within the CMS page scheduled update feature. An authenticated attacker with administrative privilege could leverage this vulnerability to achieve remote code execution on the system.

CVSS v3 7.2 HIGH

7.2^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.2 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required HIGH

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References

Link	Resource
https://helpx.adobe.com/security/products/magento/apsb21-64.html	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:magento:magento:::::commerce:::*
	cpe:2.3:a:magento:magento:::::open_source:::*
	cpe:2.3:a:magento:magento:::::commerce:::*
	cpe:2.3:a:magento:magento:::::open_source:::*
	cpe:2.3:a:magento:magento:2.3.7:-:::commerce:::*
	cpe:2.3:a:magento:magento:2.3.7:-:::open_source:::*
	cpe:2.3:a:magento:magento:2.4.2:-:::commerce:::*
	cpe:2.3:a:magento:magento:2.4.2:-:::open_source:::*
	cpe:2.3:a:magento:magento:2.4.2:p1:::commerce:::*
	cpe:2.3:a:magento:magento:2.4.2:p1:::open_source:::*

History

No history.

Information

Published : 2023-09-06 14:15

Updated : 2023-09-14 13:15

NVD link : CVE-2021-36021

Mitre link : CVE-2021-36021

CVE.ORG link : CVE-2021-36021

JSON object : View

Products Affected

magento

magento

CWE

CWE-20

Improper Input Validation

NVD-CWE-noinfo

{"id": "CVE-2021-36021", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "psirt@adobe.com", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}, {"type": "Secondary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.2, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "HIGH", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.2}]}, "published": "2023-09-06T14:15:08.767", "references": [{"url": "https://helpx.adobe.com/security/products/magento/apsb21-64.html", "tags": ["Vendor Advisory"], "source": "psirt@adobe.com"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "psirt@adobe.com", "description": [{"lang": "en", "value": "CWE-20"}]}, {"type": "Secondary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-noinfo"}]}], "descriptions": [{"lang": "en", "value": "Magento versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an Improper input validation vulnerability within the CMS page scheduled update feature. An authenticated attacker with administrative privilege could leverage this vulnerability to achieve remote code execution on the system. "}, {"lang": "es", "value": "Las versiones 2.4.2 (y anteriores), 2.4.2-p1 (y anteriores) y 2.3.7 (y anteriores) de Magento est\u00e1n afectadas por una vulnerabilidad de validaci\u00f3n de entrada Incorrecta dentro de la funci\u00f3n de actualizaci\u00f3n programada de la p\u00e1gina CMS. Un atacante autenticado con privilegios administrativos podr\u00eda aprovechar esta vulnerabilidad para lograr la ejecuci\u00f3n remota de c\u00f3digo en el sistema."}], "lastModified": "2023-09-14T13:15:07.410", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:magento:magento:*:*:*:*:commerce:*:*:*", "vulnerable": true, "matchCriteriaId": "727FB993-9F35-40EA-BF41-E4757F21C5FE", "versionEndExcluding": "2.3.7"}, {"criteria": "cpe:2.3:a:magento:magento:*:*:*:*:open_source:*:*:*", "vulnerable": true, "matchCriteriaId": "9DF037A1-026B-4083-97FB-13578A56326C", "versionEndExcluding": "2.3.7"}, {"criteria": "cpe:2.3:a:magento:magento:*:*:*:*:commerce:*:*:*", "vulnerable": true, "matchCriteriaId": "FEBAEE65-BE3C-45B8-A321-F24F90495906", "versionEndExcluding": "2.4.2", "versionStartIncluding": "2.4.0"}, {"criteria": "cpe:2.3:a:magento:magento:*:*:*:*:open_source:*:*:*", "vulnerable": true, "matchCriteriaId": "6A81A9D5-8570-430F-AD20-BEBEC3151865", "versionEndExcluding": "2.4.2", "versionStartIncluding": "2.4.0"}, {"criteria": "cpe:2.3:a:magento:magento:2.3.7:-:*:*:commerce:*:*:*", "vulnerable": true, "matchCriteriaId": "F124A6F4-E3B3-4065-970D-963BAAAD59CB"}, {"criteria": "cpe:2.3:a:magento:magento:2.3.7:-:*:*:open_source:*:*:*", "vulnerable": true, "matchCriteriaId": "4F1E5426-A646-4EC1-902A-FD30B00AD1AA"}, {"criteria": "cpe:2.3:a:magento:magento:2.4.2:-:*:*:commerce:*:*:*", "vulnerable": true, "matchCriteriaId": "58C98B8D-6E7B-44FA-8C73-D2AA1DC0A074"}, {"criteria": "cpe:2.3:a:magento:magento:2.4.2:-:*:*:open_source:*:*:*", "vulnerable": true, "matchCriteriaId": "930C8AEF-C433-4CF9-AC81-7CCFC3EDFD48"}, {"criteria": "cpe:2.3:a:magento:magento:2.4.2:p1:*:*:commerce:*:*:*", "vulnerable": true, "matchCriteriaId": "68A6F795-960A-42F0-96BA-2E3D912F3E1A"}, {"criteria": "cpe:2.3:a:magento:magento:2.4.2:p1:*:*:open_source:*:*:*", "vulnerable": true, "matchCriteriaId": "E9CD54D8-4E55-4437-B762-A68F2BE62CF3"}], "operator": "OR"}]}], "sourceIdentifier": "psirt@adobe.com"}