Description

Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to OS command injection via the WebAPI. Successful exploitation could lead to remote code execution by an authenticated attacker. Access to the admin console is required for successful exploitation.

Remediation

References

CVE-2021-21016

Related Vulnerabilities

WordPress Plugin Asset CleanUp:Page Speed Booster Multiple Vulnerabilities (1.3.6.6)

WordPress Plugin Station Pro Cross-Site Scripting (2.2.1)

WordPress Plugin WP Custom Admin Login Page Logo Unspecified Vulnerability (1.4.1)

Magento Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') Vulnerability (CVE-2019-7938)

OpenSSL Missing Encryption of Sensitive Data Vulnerability (CVE-2019-1563)

Severity

Critical

Classification

CVE-2021-21016 CWE-138 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities