CVE-2021-41143 — Command Injection in Magento-lts

CWE-77 — Command InjectionCWE-22 — Path Traversal4 documents4 sources
Severity
7.2HIGHNVD
EPSS
1.2%
top 20.86%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Openmage Magento-ltsOpenmage Magento
Timeline
PublishedJan 27

Description

OpenMage LTS is an e-commerce platform. Prior to versions 19.4.22 and 20.0.19, Magento admin users with access to the customer media could execute code on the server. Versions 19.4.22 and 20.0.19 contain a patch for this issue.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HExploitability: 1.2 | Impact: 5.9

Affected Packages3 packages

▶NVDopenmage/magento20.0.0 — 20.0.19+1
▶CVEListV5openmage/magento-lts< 19.4.22+1
▶Packagistopenmage/magento-lts20.0.0 — 20.0.19+1

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

3
CVEList
OpenMage LTS arbitrary file deletion in customer media allows for remote code execution↗2023-01-27
▶
GHSA
Fix for arbitrary file deletion in customer media allows for remote code execution↗2023-01-27
▶
OSV
Fix for arbitrary file deletion in customer media allows for remote code execution↗2023-01-27
▶
CVE-2021-41143 — Command Injection in Magento-lts | cvebase