{"id":"CVE-2021-36042","published":"2021-09-01T14:31:24Z","modified":"2024-09-17T01:25:59Z","title":"Magento Commerce API File Option Upload Extension Improper Input Validation Vulnerability Could Lead To Remote Code…","vendor":"Adobe","product":"Magento Commerce","tier":"tail","description":{"text":"Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability in the API File Option Upload Extension. An attacker with Admin privileges can achieve unrestricted file upload which can result in remote code execution.","provenance":"source","from":"CVE.org"},"cvss":{"score":9.1,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.02474,"percentile":0.84473,"provenance":"source"},"cwes":[{"id":"CWE-20","name":"Improper Input Validation"}],"references":[{"url":"https://helpx.adobe.com/security/products/magento/apsb21-64.html","tags":["x_refsource_MISC"]}],"priority":{"score":23.3,"factors":[{"name":"EPSS percentile","points":16.89},{"name":"CVSS severity","points":6.37}]},"vendorSlug":"adobe","affectedVersions":[{"vendor":"Adobe","product":"Magento Commerce","versions":[">= unspecified, <= 2.4.2",">= unspecified, <= 2.4.2-p1",">= unspecified, <= 2.3.7",">= unspecified, <= None"]}],"affected":[{"ecosystem":"Packagist","package":"magento/project-community-edition","vulnerableRanges":["<=2.0.2"],"patched":[],"from":["GHSA-6cwv-wj7v-73xp"],"provenance":"source"},{"ecosystem":"Packagist","package":"magento/community-edition","vulnerableRanges":[">=2.4.2-p1, <2.4.2-p2","<2.3.7-p1"],"patched":["2.4.2-p2","2.3.7-p1"],"from":["GHSA-6cwv-wj7v-73xp"],"provenance":"source"}],"euvd":{"id":"EUVD-2021-22675","exploited":false,"provenance":"source"}}