CVE-2021-39217: Fix for arbitrary command execution in custom layout update through blocks
Impact Custom Layout enabled admin users to execute arbitrary commands via block methods.
Other sources
Fix for arbitrary command execution in custom layout update through blocks
— Packagist
OpenMage LTS is an e-commerce platform. Prior to versions 19.4.22 and 20.0.19, Custom Layout enabled admin users to execute arbitrary commands via block methods. Versions 19.4.22 and 20.0.19 contain patches for this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/openmage/magento-ltsto a version that resolves this vulnerability.Fixed in 20.0.19 - Upgrade
Upgrade
composer/openmage/magento-ltsto a version that resolves this vulnerability.Fixed in 19.4.22 - Upgrade
Upgrade
OpenMage LTSto a version that resolves this vulnerability.Fixed in 19.4.22 - Upgrade
Upgrade
OpenMage LTSto a version that resolves this vulnerability.Fixed in 20.0.19
Event History
Frequently Asked Questions
What is CVE-2021-39217?
CVE-2021-39217 is a vulnerability in OpenMage LTS, an e-commerce platform, that allows arbitrary command execution for admin users with Custom Layout enabled.
What is the severity of CVE-2021-39217?
The severity of CVE-2021-39217 is high with a CVSS score of 7.2.
How can I check if my version of OpenMage LTS is affected by CVE-2021-39217?
To check if your version of OpenMage LTS is affected, please check the version number against either version 19.4.22 or versions between 20.0.0 and 20.0.19 (exclusive).
How do I fix CVE-2021-39217?
To fix CVE-2021-39217, update your OpenMage LTS installation to version 19.4.22 or version 20.0.19, both of which contain patches for the vulnerability.
Where can I find more information about CVE-2021-39217?
You can find more information about CVE-2021-39217 on the OpenMage GitHub repository at the following links: [Link1](https://github.com/OpenMage/magento-lts/commit/289bd4b4f53622138e3e5c2d2cef7502d780086f), [Link2](https://github.com/OpenMage/magento-lts/releases/tag/v19.4.22), [Link3](https://github.com/OpenMage/magento-lts/releases/tag/v20.0.19).