CVE-2021-36021: Magento Commerce CMS Page Improper Input Validation Could Lead To Remote Code Execution

Q: What is the vulnerability ID for this Magento vulnerability?

The vulnerability ID for this Magento vulnerability is CVE-2021-36021.

Q: What is the severity of CVE-2021-36021?

The severity of CVE-2021-36021 is high with a CVSS score of 7.2.

Q: Is there a patch available for this vulnerability?

Yes, a patch is available. Please refer to the official Magento website for more information.

Published Sep 6, 2023

Updated

Magento versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an Improper input validation vulnerability within the CMS page scheduled update feature. An authenticated attacker with administrative privilege could leverage this vulnerability to achieve remote code execution on the system.

Affected Software

10 affected components

Magento Magento<2.3.7

Magento Magento>=2.4.0<2.4.2

Magento Magento=2.3.7

Magento Magento=2.4.2

Magento Magento=2.4.2-p1

Event History

Sep 6, 2023

CVE Published

via MITRE·01:08 PM

Data Sourced

via MITRE·01:08 PM

DescriptionSeverityWeakness

Frequently Asked Questions

What is the vulnerability ID for this Magento vulnerability?

The vulnerability ID for this Magento vulnerability is CVE-2021-36021.

Which versions of Magento are affected by this vulnerability?

Magento versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier), and 2.3.7 (and earlier) are affected by this vulnerability.

What is the severity of CVE-2021-36021?

The severity of CVE-2021-36021 is high with a CVSS score of 7.2.

What is the impact of this vulnerability?

An authenticated attacker with administrative privilege could leverage this vulnerability to achieve remote code execution.

Is there a patch available for this vulnerability?