CVE-2021-36042: Magento Commerce API File Option Upload Extension Improper Input Validation Vulnerability Could Lead To Remote Code Execution
First published: Wed Sep 01 2021(Updated: )
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability in the API File Option Upload Extension. An attacker with Admin privileges can achieve unrestricted file upload which can result in remote code execution.
Credit: psirt@adobe.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Adobe Adobe Commerce | >=2.3.0<=2.3.7 | |
| Adobe Adobe Commerce | >=2.4.0<=2.4.2 | |
| Adobe Adobe Commerce | =2.4.2-p1 | |
| Adobe Magento Open Source | >=2.3.0<=2.3.7 | |
| Adobe Magento Open Source | >=2.4.0<=2.4.2 | |
| Adobe Magento Open Source | =2.4.2-p1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the vulnerability ID for this Magento Commerce vulnerability?
The vulnerability ID for this Magento Commerce vulnerability is CVE-2021-36042.
What is the severity of CVE-2021-36042?
The severity of CVE-2021-36042 is critical with a severity value of 7.2.
Which versions of Magento Commerce are affected by CVE-2021-36042?
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier), and 2.3.7 (and earlier) are affected by CVE-2021-36042.
What is the impact of CVE-2021-36042?
CVE-2021-36042 allows an attacker with Admin privileges to achieve unrestricted file upload, potentially leading to remote code execution.
Where can I find more information about CVE-2021-36042?
You can find more information about CVE-2021-36042 in the Adobe Security Bulletin APSB21-64.
- collector/nvd-index
- agent/weakness
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/author
- agent/last-modified-date
- agent/remedy
- agent/references
- agent/severity
- agent/title
- agent/tags
- agent/first-publish-date
- agent/description
- agent/event
- vendor/adobe
- canonical/adobe adobe commerce
- version/adobe adobe commerce/2.3.0
- version/adobe adobe commerce/2.3.7
- version/adobe adobe commerce/2.4.0
- version/adobe adobe commerce/2.4.2
- version/adobe adobe commerce/2.4.2-p1
- canonical/adobe magento open source
- version/adobe magento open source/2.3.0
- version/adobe magento open source/2.3.7
- version/adobe magento open source/2.4.0
- version/adobe magento open source/2.4.2
- version/adobe magento open source/2.4.2-p1