CVE-2021-32758: Layout XML Arbitrary Code Fix
Impact Layout XML enabled admin users to execute arbitrary commands via block methods.
Other sources
OpenMage Magento LTS is an alternative to the Magento CE official releases. Prior to versions 19.4.15 and 20.0.11, layout XML enabled admin users to execute arbitrary commands via block methods. The latest OpenMage Versions up from v19.4.15 and v20.0.11 have this Issue patched.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/openmage/magento-ltsto a version that resolves this vulnerability.Fixed in 20.0.13 - Upgrade
Upgrade
composer/openmage/magento-ltsto a version that resolves this vulnerability.Fixed in 19.4.15 - Upgrade
Upgrade
OpenMage Magento LTSto a version that resolves this vulnerability.Fixed in 19.4.15 - Upgrade
Upgrade
OpenMage Magento LTSto a version that resolves this vulnerability.Fixed in 20.0.11
Event History
Frequently Asked Questions
What is CVE-2021-32758?
CVE-2021-32758 is a vulnerability in OpenMage Magento LTS that allows admin users to execute arbitrary commands via block methods.
How severe is CVE-2021-32758?
CVE-2021-32758 has a severity rating of 7.2, which is classified as critical.
Is my version of OpenMage affected by CVE-2021-32758?
If your OpenMage version is prior to 19.4.15 or between 20.0.00 and 20.0.11, then it is affected by CVE-2021-32758.
How can I fix CVE-2021-32758?
To fix CVE-2021-32758, you should update your OpenMage version to the latest release, starting from v19.4.15 or v20.0.11, as they have patched this issue.
Where can I find more information about CVE-2021-32758?
You can find more information about CVE-2021-32758 on the OpenMage GitHub repository, including the patched versions and security advisories.