CVE-2021-36023: Magento Commerce Widgets Update Layout XML Injection Vulnerability Could Lead To Remote Code Execution
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability in the Widgets Update Layout. An attacker with admin privileges can trigger a specially crafted script to achieve remote code execution.
Affected Software
Event History
Frequently Asked Questions
What is CVE-2021-36023?
CVE-2021-36023 is a vulnerability in Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier), and 2.3.7 (and earlier) that allows an attacker with admin privileges to achieve remote code execution.
How does CVE-2021-36023 affect Magento Commerce?
CVE-2021-36023 affects Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier), and 2.3.7 (and earlier) by enabling an XML Injection vulnerability in the Widgets Update Layout.
What is the severity of CVE-2021-36023?
CVE-2021-36023 has a severity rating of critical with a score of 7.2.
How can an attacker exploit CVE-2021-36023?
An attacker with admin privileges can trigger a specially crafted script to exploit the XML Injection vulnerability and achieve remote code execution.
Is there a fix for CVE-2021-36023?
Yes, upgrading to Magento Commerce versions 2.4.3, 2.4.2-p1, or 2.3.8-p1 addresses the vulnerability.