TI-2021-09655 Aliases CVE-2021-28583 GHSA-7gh6-f4jh-3crq

Magento Commerce insecure storage of sensitive documentation

LOW 37CWE-657Published 2021-06-28 · Updated 2024-09-17

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Impact type: —
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub.

Summary

Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are affected by a Violation of Secure Design Principles vulnerability in RMA PDF filename formats. Successful exploitation could allow an attacker to get unauthorized access to restricted resources.

Why it matters now

EPSS 0.01897 79th percentileScored 2026-11-07

Fix Fixed magento/community-edition (Packagist): 2.4.2-p1, 2.3.7

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Adobe	Magento Commerce	up to 2.4.2; up to 2.3.6-p1; up to 2.4.1-p1; up to None	—	No fix listed	CNA
—	magento/community-edition (Packagist)	2.4.0 to before 2.4.2-p1	2.4.2-p1	Patch available	GHSA-7gh6-f4jh-3crq
—	magento/community-edition (Packagist)	before 2.3.7	2.3.7	Patch available	GHSA-7gh6-f4jh-3crq
—	magento/project-community-edition (Packagist)	up to 2.0.2	—	No fix listed	GHSA-7gh6-f4jh-3crq

Magento Commerce VendorAdobe Affected up to 2.4.2; up to 2.3.6-p1; up to 2.4.1-p1; up to None Fixed in — No fix listed CNA
magento/community-edition (Packagist) Vendor— Affected 2.4.0 to before 2.4.2-p1 Fixed in 2.4.2-p1 Patch available GHSA-7gh6-f4jh-3crq
magento/community-edition (Packagist) Vendor— Affected before 2.3.7 Fixed in 2.3.7 Patch available GHSA-7gh6-f4jh-3crq
magento/project-community-edition (Packagist) Vendor— Affected up to 2.0.2 Fixed in — No fix listed GHSA-7gh6-f4jh-3crq

CPE configurations NVD · 12

CPE	Versions	Role	Vendor
cpe:2.3:a:magento:magento:::::commerce:::*	before 2.3.6	Vulnerable	Magento
cpe:2.3:a:magento:magento:::::open_source:::*	before 2.3.6	Vulnerable	Magento
cpe:2.3:a:magento:magento:2.3.6:-:::commerce:::*	2.3.6	Vulnerable	Magento
cpe:2.3:a:magento:magento:2.3.6:-:::open_source:::*	2.3.6	Vulnerable	Magento
cpe:2.3:a:magento:magento:2.3.6:p1:::commerce:::*	2.3.6 p1	Vulnerable	Magento
cpe:2.3:a:magento:magento:2.3.6:p1:::open_source:::*	2.3.6 p1	Vulnerable	Magento
cpe:2.3:a:magento:magento:2.4.1:-:::commerce:::*	2.4.1	Vulnerable	Magento
cpe:2.3:a:magento:magento:2.4.1:-:::open_source:::*	2.4.1	Vulnerable	Magento
cpe:2.3:a:magento:magento:2.4.1:p1:::commerce:::*	2.4.1 p1	Vulnerable	Magento
cpe:2.3:a:magento:magento:2.4.1:p1:::open_source:::*	2.4.1 p1	Vulnerable	Magento

cpe:2.3:a:magento:magento:*:*:*:*:commerce:*:*:* Versions before 2.3.6 Vulnerable ·Magento
cpe:2.3:a:magento:magento:*:*:*:*:open_source:*:*:* Versions before 2.3.6 Vulnerable ·Magento
cpe:2.3:a:magento:magento:2.3.6:-:*:*:commerce:*:*:* Versions 2.3.6 Vulnerable ·Magento
cpe:2.3:a:magento:magento:2.3.6:-:*:*:open_source:*:*:* Versions 2.3.6 Vulnerable ·Magento
cpe:2.3:a:magento:magento:2.3.6:p1:*:*:commerce:*:*:* Versions 2.3.6 p1 Vulnerable ·Magento
cpe:2.3:a:magento:magento:2.3.6:p1:*:*:open_source:*:*:* Versions 2.3.6 p1 Vulnerable ·Magento
cpe:2.3:a:magento:magento:2.4.1:-:*:*:commerce:*:*:* Versions 2.4.1 Vulnerable ·Magento
cpe:2.3:a:magento:magento:2.4.1:-:*:*:open_source:*:*:* Versions 2.4.1 Vulnerable ·Magento
cpe:2.3:a:magento:magento:2.4.1:p1:*:*:commerce:*:*:* Versions 2.4.1 p1 Vulnerable ·Magento
cpe:2.3:a:magento:magento:2.4.1:p1:*:*:open_source:*:*:* Versions 2.4.1 p1 Vulnerable ·Magento

Show 2 more CPE

CPE	Versions	Role	Vendor
cpe:2.3:a:magento:magento:2.4.2::::commerce:::	2.4.2	Vulnerable	Magento
cpe:2.3:a:magento:magento:2.4.2::::open_source:::	2.4.2	Vulnerable	Magento

cpe:2.3:a:magento:magento:2.4.2:*:*:*:commerce:*:*:* Versions 2.4.2 Vulnerable ·Magento
cpe:2.3:a:magento:magento:2.4.2:*:*:*:open_source:*:*:* Versions 2.4.2 Vulnerable ·Magento

Remediation

Fix · GHSA-7gh6-f4jh-3crq magento/community-edition (Packagist) Fixed in 2.4.2-p1 Advisory →
Fix · GHSA-7gh6-f4jh-3crq magento/community-edition (Packagist) Fixed in 2.3.7 Advisory →

Timeline

2026-10-02 Threatist record created from CVE-2021-28583
2026-10-03 Alias added: GHSA-7gh6-f4jh-3crq

References

Patch 1

https://helpx.adobe.com/security/products/magento/apsb21-30.html

Advisory 1

https://nvd.nist.gov/vuln/detail/CVE-2021-28583

Other 2

TI-2026-52938 Adobe Commerce | Improper Neutralization of Special Elements Used in a Template Engine (CWE-1336) KEVCVSS 3.1CRITICAL 10.0
TI-2026-35688 ColdFusion | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22) KEVCVSS 3.1CRITICAL 10.0
TI-2025-34084 Adobe Experience Manager | Incorrect Authorization (CWE-863) KEVCVSS 3.1CRITICAL 10.0
TI-2024-22559 XXE can expose crypt key and other secrets granting full admin access KEVCVSS 3.1CRITICAL 9.8
TI-2023-19615 Analysis CVE-2023-29300 Bypass: Adobe ColdFusion Pre-Auth RCE KEVCVSS 3.1CRITICAL 9.8
TI-2023-13696 Adobe ColdFusion Deserialization of Untrusted Data Arbitrary code execution KEVCVSS 3.1CRITICAL 9.8

See all 8046 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences