CVE-2021-28566: Magento Information Disclosure vulnerability
Magento Information Disclosure vulnerability
Other sources
Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are vulnerable to an Information Disclosure vulnerability when uploading a modified png file to a product image. Successful exploitation could lead to the disclosure of document root path by an unauthenticated attacker. Access to the admin console is required for successful exploitation.
— GitHub
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/magento/community-editionto a version that resolves this vulnerability.Fixed in 2.3.7 - Upgrade
Upgrade
composer/magento/community-editionto a version that resolves this vulnerability.Fixed in 2.4.2-p1
Event History
Frequently Asked Questions
What is the vulnerability ID for this Magento vulnerability?
The vulnerability ID for this Magento vulnerability is CVE-2021-28566.
What is the severity of CVE-2021-28566?
CVE-2021-28566 has a severity level of medium.
Which versions of Magento are affected by CVE-2021-28566?
Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier), and 2.3.6-p1 (and earlier) are affected by CVE-2021-28566.
What is the impact of CVE-2021-28566?
Successful exploitation of CVE-2021-28566 could lead to the disclosure of the document root path.
Is authentication required to exploit CVE-2021-28566?
No, CVE-2021-28566 can be exploited by an unauthenticated attacker.