CVE-2021-21029: Magento Reflected Cross-site Scripting vulnerability via 'file' parameter
Magento Reflected Cross-site Scripting vulnerability via 'file' parameter
Other sources
Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are affected by a Reflected Cross-site Scripting vulnerability via 'file' parameter. Successful exploitation could lead to arbitrary JavaScript execution in the victim's browser. Access to the admin console is required for successful exploitation.
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/magento/community-editionto a version that resolves this vulnerability.Fixed in 2.4.2 - Upgrade
Upgrade
composer/magento/community-editionto a version that resolves this vulnerability.Fixed in 2.3.6-p1
Event History
Frequently Asked Questions
What is the vulnerability ID of this Magento vulnerability?
The vulnerability ID of this Magento vulnerability is CVE-2021-21029.
What versions of Magento are affected by this vulnerability?
Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier), and 2.3.6 (and earlier) are affected by this vulnerability.
What is the severity of CVE-2021-21029?
The severity of CVE-2021-21029 is medium with a CVSS score of 4.8.
What is the impact of this vulnerability?
Successful exploitation of this vulnerability could lead to arbitrary JavaScript execution in the victim's browser.
How can I fix CVE-2021-21029 in my Magento installation?
To fix CVE-2021-21029, it is recommended to update Magento to version 2.4.2 or apply the necessary patches provided by Magento.