CVE-2021-28566: Magento Commerce information disclosure during upload action leveraging a specially crafted file
Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are vulnerable to an Information Disclosure vulnerability when uploading a modified png file to a product image. Successful exploitation could lead to the disclosure of document root path by an unauthenticated attacker. Access to the admin console is required for successful exploitation.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this Magento vulnerability?
The vulnerability ID for this Magento vulnerability is CVE-2021-28566.
What is the severity of CVE-2021-28566?
CVE-2021-28566 has a severity level of medium.
Which versions of Magento are affected by CVE-2021-28566?
Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier), and 2.3.6-p1 (and earlier) are affected by CVE-2021-28566.
What is the impact of CVE-2021-28566?
Successful exploitation of CVE-2021-28566 could lead to the disclosure of the document root path.
Is authentication required to exploit CVE-2021-28566?
No, CVE-2021-28566 can be exploited by an unauthenticated attacker.