BIT-magento-2021-36023
See a problem?- Import Source
- https://github.com/bitnami/vulndb/tree/main/data/magento/BIT-magento-2021-36023.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/BIT-magento-2021-36023
- Aliases
- Published
- 2024-03-06T10:57:34.606Z
- Modified
- 2026-03-20T10:01:49.008877Z
- Summary
- Magento Commerce Widgets Update Layout XML Injection Vulnerability Could Lead To Remote Code Execution
- Details
-
Magento Commerce versions 2.4.2 (and earlier), 2.4.2 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability in the Widgets Update Layout. An attacker with admin privileges can trigger a specially crafted script to achieve remote code execution.
- Database specific
{ "cpes": [ "cpe:2.3:a:magento:magento:*:*:*:*:commerce:*:*:*", "cpe:2.3:a:magento:magento:*:*:*:*:open_source:*:*:*", "cpe:2.3:a:magento:magento:2.3.7:-:*:*:commerce:*:*:*", "cpe:2.3:a:magento:magento:2.3.7:-:*:*:open_source:*:*:*", "cpe:2.3:a:magento:magento:2.4.2:-:*:*:commerce:*:*:*", "cpe:2.3:a:magento:magento:2.4.2:-:*:*:open_source:*:*:*", "cpe:2.3:a:magento:magento:2.4.2:p1:*:*:commerce:*:*:*", "cpe:2.3:a:magento:magento:2.4.2:p1:*:*:open_source:*:*:*" ], "severity": "High" }- References
Affected packages
Bitnami / magento
Package
- Name
- magento
- Purl
- pkg:bitnami/magento
Severity
- 7.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H CVSS Calculator