CVE-2021-36036

Опубликовано: 06 сент. 2023

Источник: nvd

CVSS3: 7.2

EPSS Низкий

Описание

Magento versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper access control vulnerability within Magento's Media Gallery Upload workflow. By storing a specially crafted file in the website gallery, an authenticated attacker with administrative privilege can gain access to delete the .htaccess file. This could result in the attacker achieving remote code execution.

Ссылки

https://helpx.adobe.com/security/products/magento/apsb21-64.html
Vendor Advisory
https://helpx.adobe.com/security/products/magento/apsb21-64.html
Vendor Advisory

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:a:magento:magento:*:*:*:*:commerce:*:*:*

Версия до 2.3.7 (исключая)

cpe:2.3:a:magento:magento:*:*:*:*:open_source:*:*:*

Версия до 2.3.7 (исключая)

cpe:2.3:a:magento:magento:*:*:*:*:commerce:*:*:*

Версия от 2.4.0 (включая) до 2.4.2 (исключая)

cpe:2.3:a:magento:magento:*:*:*:*:open_source:*:*:*

Версия от 2.4.0 (включая) до 2.4.2 (исключая)

cpe:2.3:a:magento:magento:2.3.7:-:*:*:commerce:*:*:*

cpe:2.3:a:magento:magento:2.3.7:-:*:*:open_source:*:*:*

cpe:2.3:a:magento:magento:2.4.2:-:*:*:commerce:*:*:*

cpe:2.3:a:magento:magento:2.4.2:-:*:*:open_source:*:*:*

cpe:2.3:a:magento:magento:2.4.2:p1:*:*:commerce:*:*:*

cpe:2.3:a:magento:magento:2.4.2:p1:*:*:open_source:*:*:*

EPSS

Процентиль: 78%

0.01182

Низкий

7.2 High

CVSS3

Дефекты

CWE-284

Связанные уязвимости

GHSA-wqr6-wv6c-p8fx

CVSS3: 9.1

github

больше 2 лет назад

Magento improper access control vulnerability within Magento's Media Gallery Upload workflow

BDU:2022-01372