Vulnerability Description
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability while saving a customer's details with a specially crafted file. An authenticated attacker with admin privileges can leverage this vulnerability to achieve remote code execution.
CVSS Score
CRITICAL
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Adobe | Adobe Commerce | >= 2.3.0, <= 2.3.7 |
| Adobe | Magento Open Source | >= 2.3.0, <= 2.3.7 |
Related Weaknesses (CWE)
References
- https://helpx.adobe.com/security/products/magento/apsb21-64.htmlPatchVendor Advisory
- https://helpx.adobe.com/security/products/magento/apsb21-64.htmlPatchVendor Advisory
FAQ
What is CVE-2021-36025?
CVE-2021-36025 is a vulnerability with a CVSS score of 9.1 (CRITICAL). Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability while saving a customer's details with a specia...
How severe is CVE-2021-36025?
CVE-2021-36025 has been rated CRITICAL with a CVSS base score of 9.1/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2021-36025?
Check the references section above for vendor advisories and patch information. Affected products include: Adobe Adobe Commerce, Adobe Magento Open Source.