CVE-2021-41231: OpenMage LTS DataFlow upload remote code execution vulnerability
OpenMage LTS is an e-commerce platform. Prior to versions 19.4.22 and 20.0.19, an administrator with the permissions to upload files via DataFlow and to create products was able to execute arbitrary code via the convert profile. Versions 19.4.22 and 20.0.19 contain a patch for this issue.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is CVE-2021-41231?
CVE-2021-41231 is a vulnerability in the OpenMage LTS e-commerce platform that allows an administrator to execute arbitrary code via the convert profile.
How severe is CVE-2021-41231?
CVE-2021-41231 has a severity rating of 7.2 (high).
Which versions of OpenMage LTS are affected by CVE-2021-41231?
Versions prior to 19.4.22 and 20.0.19 of OpenMage LTS are affected by CVE-2021-41231.
How can I fix CVE-2021-41231?
To fix CVE-2021-41231, you should update your OpenMage LTS installation to version 19.4.22 or 20.0.19 which contain a patch for this vulnerability.
Where can I find more information about CVE-2021-41231?
You can find more information about CVE-2021-41231 on the following links: [Link 1](https://github.com/OpenMage/magento-lts/commit/d16fc6c5a1e66c6f0d9f82020f11702a7ddd78e4), [Link 2](https://github.com/OpenMage/magento-lts/releases/tag/v19.4.22), [Link 3](https://github.com/OpenMage/magento-lts/releases/tag/v20.0.19).