CVE-2021-41231: DataFlow upload remote code execution vulnerability
Impact An administrator with the permissions to upload files via DataFlow and to create products was able to execute arbitrary code via the convert profile.
Other sources
DataFlow upload remote code execution vulnerability
— Packagist
OpenMage LTS is an e-commerce platform. Prior to versions 19.4.22 and 20.0.19, an administrator with the permissions to upload files via DataFlow and to create products was able to execute arbitrary code via the convert profile. Versions 19.4.22 and 20.0.19 contain a patch for this issue.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/openmage/magento-ltsto a version that resolves this vulnerability.Fixed in 20.0.19 - Upgrade
Upgrade
composer/openmage/magento-ltsto a version that resolves this vulnerability.Fixed in 19.4.22 - Upgrade
Upgrade
OpenMage LTSto a version that resolves this vulnerability.Fixed in 19.4.22 - Upgrade
Upgrade
OpenMage LTSto a version that resolves this vulnerability.Fixed in 20.0.19
Event History
Frequently Asked Questions
What is CVE-2021-41231?
CVE-2021-41231 is a vulnerability in the OpenMage LTS e-commerce platform that allows an administrator to execute arbitrary code via the convert profile.
How severe is CVE-2021-41231?
CVE-2021-41231 has a severity rating of 7.2 (high).
Which versions of OpenMage LTS are affected by CVE-2021-41231?
Versions prior to 19.4.22 and 20.0.19 of OpenMage LTS are affected by CVE-2021-41231.
How can I fix CVE-2021-41231?
To fix CVE-2021-41231, you should update your OpenMage LTS installation to version 19.4.22 or 20.0.19 which contain a patch for this vulnerability.
Where can I find more information about CVE-2021-41231?
You can find more information about CVE-2021-41231 on the following links: [Link 1](https://github.com/OpenMage/magento-lts/commit/d16fc6c5a1e66c6f0d9f82020f11702a7ddd78e4), [Link 2](https://github.com/OpenMage/magento-lts/releases/tag/v19.4.22), [Link 3](https://github.com/OpenMage/magento-lts/releases/tag/v20.0.19).