CVE-2021-36041: Magento Commerce Improper Input Validation Could Lead To Remote Code Execution
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability. An attacker with admin privileges could upload a specially crafted file in the 'pub/media directory could lead to remote code execution.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2021-36041?
CVE-2021-36041 is a vulnerability in Magento Commerce versions 2.4.2 (and earlier) 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) that allows an attacker with admin privileges to upload a specially crafted file and execute remote code.
What is the severity of CVE-2021-36041?
The severity of CVE-2021-36041 is critical with a CVSSv3 score of 7.2.
How does CVE-2021-36041 affect Adobe Adobe Commerce?
Adobe Adobe Commerce versions 2.3.0 to 2.3.7 are affected by CVE-2021-36041.
How does CVE-2021-36041 affect Adobe Magento Open Source?
Adobe Magento Open Source versions 2.3.0 to 2.3.7 are affected by CVE-2021-36041.
How do I fix CVE-2021-36041?
Update your Magento Commerce installation to version 2.4.2-p1 or later, or upgrade to Magento Commerce versions 2.4.3, 2.3.8, or 2.4.3-p1 to mitigate CVE-2021-36041.