Description

Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are affected by a Path Traversal vulnerability when creating a store with child theme.Successful exploitation could lead to arbitrary file system write by an authenticated attacker. Access to the admin console is required for successful exploitation.

Remediation

References

CVE-2021-28584

Related Vulnerabilities

Jetty Improper Neutralization of Quoting Syntax Vulnerability (CVE-2023-36479)

axios Unintended Proxy or Intermediary ('Confused Deputy') Vulnerability (CVE-2026-44494)

Oracle JRE CVE-2020-2654 Vulnerability (CVE-2020-2654)

Oracle JRE Permissions, Privileges, and Access Controls Vulnerability (CVE-2012-3174)

Undertow Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting') Vulnerability (CVE-2018-1067)

Severity

High

Classification

CVE-2021-28584 CWE-22 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities