CVE-2021-21019
Magento Commerce XML Injection Could Lead To Remote Code Execution
- State
- Published
- Severity
- 9.1 Critical
- Published
- Feb 11, 2021
- Updated
- Sep 17, 2024
- Reserved
- Dec 18, 2020
Description
Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to XML injection in the Widgets module. Successful exploitation could lead to arbitrary code execution by an authenticated attacker. Access to the admin console is required for successful exploitation.
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.0 | 9.1 Critical | CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H | adobe |
Weaknesses
- CWE-91 XML Injection (aka Blind XPath Injection) (CWE-91)
Affected Products
| Product | Versions |
|---|---|
Magento CommerceAdobe |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.