CVE-2021-36036
Magento Commerce Media Gallery Upload Improper Access Control Could Lead To Remote Code Execution
Vexday Risk Score
21Bajo
Decisión SSVC (CISA)
Track
Sin señal de explotación → monitorear
CVSS 7.2EPSS 2.1%KEV nãoPoC —Nuclei —Metasploit —Patch referenciado
Ciclo de vida
06 sep 2023Publicada en NVD
Recomendación: Monitorear — sin señal de explotación por ahora.
Magento versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper access control vulnerability within Magento's Media Gallery Upload workflow. By storing a specially crafted file in the website gallery, an authenticated attacker with administrative privilege can gain access to delete the .htaccess file. This could result in the attacker achieving remote code execution.
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Productos afectados
Adobe · Adobe Commerce¿Quieres saber si tu infraestructura está expuesta a esto?
Hablar con TrueHacking →