Magento Commerce CMS Page Improper Input Validation Could Lead To Remote Code Execution (Adobe Adobe Commerce)
En bref
- Source
- NVD
- EPSS
- EPSS 2.01 % · centile 81 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- adobe
- Statut NVD
- Modified
Rechercher sur…
Description
Magento versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an Improper input validation vulnerability within the CMS page scheduled update feature. An authenticated attacker with administrative privilege could leverage this vulnerability to achieve remote code execution on the system.
Faiblesses (CWE)
- CWE-20 — Validation d'entrée incorrecte
Références
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.2 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H | adobe |
| CVSS 3.1 | HIGH 7.2 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H | NVD · psirt@adobe.com (Secondary) |
| CVSS 3.1 | HIGH 7.2 | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H | NVD · nvd@nist.gov (Secondary) |
Avis
- GHSA-4g27-q2w9-m8m8 — Magento affected by remote code execution vulnerability in the CMS page scheduled update feature
Références européennes
- ENISA EUVD · EUVD-2021-22654
- GCVE · GCVE-0-2021-36021
Avis du CERT-FR
- CERTFR-2021-AVI-609 — Multiples vulnérabilités dans Magento · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:a:magento:magento:*:*:*:*:commerce:*:*:*< 2.3.7cpe:2.3:a:magento:magento:*:*:*:*:open_source:*:*:*< 2.3.7cpe:2.3:a:magento:magento:*:*:*:*:commerce:*:*:*≥ 2.4.0 < 2.4.2cpe:2.3:a:magento:magento:*:*:*:*:open_source:*:*:*≥ 2.4.0 < 2.4.2cpe:2.3:a:magento:magento:2.3.7:-:*:*:commerce:*:*:*cpe:2.3:a:magento:magento:2.3.7:-:*:*:open_source:*:*:*cpe:2.3:a:magento:magento:2.4.2:-:*:*:commerce:*:*:*cpe:2.3:a:magento:magento:2.4.2:-:*:*:open_source:*:*:*cpe:2.3:a:magento:magento:2.4.2:p1:*:*:commerce:*:*:*cpe:2.3:a:magento:magento:2.4.2:p1:*:*:open_source:*:*:*
Produits affectés
| Produit | Versions |
|---|---|
| Adobe · Adobe Commerce | affected 0 ≤ 2.3.7 |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |