CVE-2021-39217: OpenMage LTS arbitrary command execution in custom layout update through blocks
OpenMage LTS is an e-commerce platform. Prior to versions 19.4.22 and 20.0.19, Custom Layout enabled admin users to execute arbitrary commands via block methods. Versions 19.4.22 and 20.0.19 contain patches for this issue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2021-39217?
CVE-2021-39217 is a vulnerability in OpenMage LTS, an e-commerce platform, that allows arbitrary command execution for admin users with Custom Layout enabled.
What is the severity of CVE-2021-39217?
The severity of CVE-2021-39217 is high with a CVSS score of 7.2.
How can I check if my version of OpenMage LTS is affected by CVE-2021-39217?
To check if your version of OpenMage LTS is affected, please check the version number against either version 19.4.22 or versions between 20.0.0 and 20.0.19 (exclusive).
How do I fix CVE-2021-39217?
To fix CVE-2021-39217, update your OpenMage LTS installation to version 19.4.22 or version 20.0.19, both of which contain patches for the vulnerability.
Where can I find more information about CVE-2021-39217?
You can find more information about CVE-2021-39217 on the OpenMage GitHub repository at the following links: [Link1](https://github.com/OpenMage/magento-lts/commit/289bd4b4f53622138e3e5c2d2cef7502d780086f), [Link2](https://github.com/OpenMage/magento-lts/releases/tag/v19.4.22), [Link3](https://github.com/OpenMage/magento-lts/releases/tag/v20.0.19).