CVE-2021-21014
published 2021-02-11CVE-2021-21014: Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to a file upload restriction bypass. Successful…
PriorityP350critical9.1CVSS 3.0
AVNACLPRHUINSCCHIHAH
EPSS
4.21%
89.7th percentile
Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to a file upload restriction bypass. Successful exploitation could lead to arbitrary code execution by an authenticated attacker. Access to the admin console is required for successful exploitation.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| adobe | magento_commerce | unspecified – 2.4.1 | — |
| magento | community-edition | >= 0 < 2.3.6-p1 | 2.3.6-p1 |
| magento | community-edition | >= 2.4.0 < 2.4.2 | 2.4.2 |
| magento | magento | < 2.3.6 | 2.3.6 |
| magento | magento | — | — |
| magento | magento | — | — |
| magento | magento | — | — |
| magento | project-community-edition | 0 – 2.0.2 | — |
CVSS provenance
nvdv3.09.1CRITICALCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Magento vulnerable to a file upload restriction bypass
ghsa·2022-05-24
CVE-2021-21014 [CRITICAL] CWE-434 Magento vulnerable to a file upload restriction bypass
Magento vulnerable to a file upload restriction bypass
Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to a file upload restriction bypass. Successful exploitation could lead to arbitrary code execution by an authenticated attacker. Access to the admin console is required for successful exploitation.
OSV
Magento vulnerable to a file upload restriction bypass
osv·2022-05-24
CVE-2021-21014 [CRITICAL] Magento vulnerable to a file upload restriction bypass
Magento vulnerable to a file upload restriction bypass
Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to a file upload restriction bypass. Successful exploitation could lead to arbitrary code execution by an authenticated attacker. Access to the admin console is required for successful exploitation.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2021-02-11
Published