CVE-2021-36023: Magento XML Injection vulnerability in the Widgets Update Layout
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability in the Widgets Update Layout. An attacker with admin privileges can trigger a specially crafted script to achieve remote code execution.
Other sources
Magento XML Injection vulnerability in the Widgets Update Layout
— Packagist
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/magento/community-editionto a version that resolves this vulnerability.Fixed in 2.4.2-p2 - Upgrade
Upgrade
composer/magento/community-editionto a version that resolves this vulnerability.Fixed in 2.3.7-p1
Event History
Frequently Asked Questions
What is CVE-2021-36023?
CVE-2021-36023 is a vulnerability in Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier), and 2.3.7 (and earlier) that allows an attacker with admin privileges to achieve remote code execution.
How does CVE-2021-36023 affect Magento Commerce?
CVE-2021-36023 affects Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier), and 2.3.7 (and earlier) by enabling an XML Injection vulnerability in the Widgets Update Layout.
What is the severity of CVE-2021-36023?
CVE-2021-36023 has a severity rating of critical with a score of 7.2.
How can an attacker exploit CVE-2021-36023?
An attacker with admin privileges can trigger a specially crafted script to exploit the XML Injection vulnerability and achieve remote code execution.
Is there a fix for CVE-2021-36023?
Yes, upgrading to Magento Commerce versions 2.4.3, 2.4.2-p1, or 2.3.8-p1 addresses the vulnerability.