{"id":"CVE-2021-36043","published":"2021-09-01T14:31:38Z","modified":"2024-09-16T20:36:46Z","title":"Magento Commerce Authenticated Blind SSRF Could Lead To Remote Code Execution","vendor":"Adobe","product":"Magento Commerce","tier":"tail","description":{"text":"Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a blind SSRF vulnerability in the bundled dotmailer extension. An attacker with admin privileges could abuse this to achieve remote code execution should Redis be enabled.","provenance":"source","from":"CVE.org"},"cvss":{"score":8,"severity":"HIGH","version":"3.1","vector":"CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H","provenance":"source","from":"CVE.org CNA"},"epss":{"score":0.01947,"percentile":0.80126,"provenance":"source"},"cwes":[{"id":"CWE-918","name":"Server-Side Request Forgery"}],"references":[{"url":"https://helpx.adobe.com/security/products/magento/apsb21-64.html","tags":["x_refsource_MISC"]}],"priority":{"score":21.6,"factors":[{"name":"EPSS percentile","points":16.03},{"name":"CVSS severity","points":5.6}]},"vendorSlug":"adobe","affectedVersions":[{"vendor":"Adobe","product":"Magento Commerce","versions":[">= unspecified, <= 2.4.2",">= unspecified, <= 2.4.2-p1",">= unspecified, <= 2.3.7",">= unspecified, <= None"]}],"affected":[{"ecosystem":"Packagist","package":"magento/project-community-edition","vulnerableRanges":["<=2.0.2"],"patched":[],"from":["GHSA-36xq-7w8w-xp68"],"provenance":"source"},{"ecosystem":"Packagist","package":"magento/community-edition","vulnerableRanges":["<2.3.7-p1",">=2.4.2-p1, <2.4.2-p2"],"patched":["2.3.7-p1","2.4.2-p2"],"from":["GHSA-36xq-7w8w-xp68"],"provenance":"source"}],"euvd":{"id":"EUVD-2021-22676","exploited":false,"provenance":"source"}}