CVE-2021-36028: Magento Commerce XML Injection Vulnerability Could Lead To Remote Code Execution
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability when saving a configurable product. An attacker with admin privileges can trigger a specially crafted script to achieve remote code execution.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2021-36028?
CVE-2021-36028 is an XML Injection vulnerability in Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier), and 2.3.7 (and earlier), which allows an attacker with admin privileges to achieve remote code execution.
How does CVE-2021-36028 affect Adobe Commerce and Magento Open Source?
CVE-2021-36028 affects Adobe Commerce versions 2.3.0 to 2.3.7, 2.4.0 to 2.4.2, and 2.4.2-p1. It also affects Magento Open Source versions 2.3.0 to 2.3.7, 2.4.0 to 2.4.2, and 2.4.2-p1.
What is the severity of CVE-2021-36028?
CVE-2021-36028 has a severity rating of 7.2, which is classified as critical.
How can an attacker exploit CVE-2021-36028?
An attacker with admin privileges can exploit CVE-2021-36028 by triggering a specially crafted script when saving a configurable product, leading to remote code execution.
Where can I find more information about CVE-2021-36028?
You can find more information about CVE-2021-36028 at the following reference: [link](https://helpx.adobe.com/security/products/magento/apsb21-64.html)