Vulnerabilities

TI-2021-14486 CVE-2021-36036 · GHSA-wqr6-wv6c-p8fx

Magento Commerce Media Gallery Upload Improper Access Control Could Lead To Remote Code Execution

LOW 38

Magento versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper access control vulnerability within Magento's Media Gallery Upload workflow.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.02116 Published 2023-09-06 Fixed in 2.3.7-p1, 2.4.2-p2 CWE-284

TI-2021-14471 CVE-2021-36021 · GHSA-4g27-q2w9-m8m8

Magento Commerce CMS Page Improper Input Validation Could Lead To Remote Code Execution

LOW 38

Magento versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an Improper input validation vulnerability within the CMS page scheduled update feature.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.02012 Published 2023-09-06 Fixed in 2.3.7-p1, 2.4.2-p2 CWE-20

TI-2021-14473 CVE-2021-36023 · GHSA-8cjg-f53m-8m9q

Magento Commerce Widgets Update Layout XML Injection Vulnerability Could Lead To Remote Code Execution

MEDIUM 46

Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability in the Widgets Update Layout.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.02366 Published 2023-09-06 Fixed in 2.3.7-p1, 2.4.2-p2 CWE-78

Vulnerabilities

Filters

Magento Commerce Media Gallery Upload Improper Access Control Could Lead To Remote Code Execution

Magento Commerce CMS Page Improper Input Validation Could Lead To Remote Code Execution

Magento Commerce Widgets Update Layout XML Injection Vulnerability Could Lead To Remote Code Execution