What is GHSA-rv48-v862-mp92?

GHSA-rv48-v862-mp92 is a security advisory published by GitHub Security Advisories with Critical severity. Magento OS Command Injection

Which CVE IDs does GHSA-rv48-v862-mp92 cover?

GHSA-rv48-v862-mp92 covers the following CVE IDs: CVE-2021-21018. Each CVE has its own detail page on EchelonGraph Pulse with the synthesized EG score.

What is the CVSS v3 score of GHSA-rv48-v862-mp92?

GHSA-rv48-v862-mp92 has a CVSS v3 base score of 9.1, published by GitHub Security Advisories.

Which products are affected by GHSA-rv48-v862-mp92?

GHSA-rv48-v862-mp92 affects 2 products, including: composer/magento/community-edition:\u003c 2.3.6; composer/magento/community-edition:\u003e= 2.4.0, \u003c 2.4.1-p1.

GHSA-rv48-v862-mp92CriticalCVSS 9.1

Magento OS Command Injection

Vendor

GitHub Security Advisories

Published

May 24, 2022

Last Modified

January 10, 2024

🔗 CVE IDs covered (1)

CVE-2021-21018 →

📋 Description

Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to OS command injection via the scheduled operation module. Successful exploitation could lead to arbitrary code execution by an authenticated attacker. Access to the admin console is required for successful exploitation.

🎯 Affected products2

composer/magento/community-edition:< 2.3.6
composer/magento/community-edition:>= 2.4.0, < 2.4.1-p1

🔗 References (3)

https://nvd.nist.gov/vuln/detail/CVE-2021-21018
https://helpx.adobe.com/security/products/magento/apsb21-08.html
https://github.com/advisories/GHSA-rv48-v862-mp92