CVE-2021-36042— Magento Commerce 和 Magento Open Source 代码问题漏洞
新しい脆弱性情報の通知を購読するログインして購読
I. CVE-2021-36042の基本情報
脆弱性情報
脆弱性についてご質問がありますか？Shenlongの分析が参考になるかご確認ください！
Shenlongの10の質問を表示 ↗ 高度な大規模言語モデル技術を使用していますが、出力には不正確または古い情報が含まれる可能性があります。Shenlongはデータの正確性を確保するよう努めていますが、実際の状況に基づいて検証・判断してください。
脆弱性タイトル
Magento Commerce API File Option Upload Extension Improper Input Validation Vulnerability Could Lead To Remote Code Execution
ソース: NVD (National Vulnerability Database)
脆弱性説明
Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability in the API File Option Upload Extension. An attacker with Admin privileges can achieve unrestricted file upload which can result in remote code execution.
ソース: NVD (National Vulnerability Database)
CVSS情報
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
ソース: NVD (National Vulnerability Database)
脆弱性タイプ
输入验证不恰当
ソース: NVD (National Vulnerability Database)
脆弱性タイトル
Magento Commerce 和 Magento Open Source 代码问题漏洞
ソース: CNNVD (China National Vulnerability Database)
脆弱性説明
Magento Open Source是提供基本的电子商务功能，允许您从头开始构建独特的在线商店。Magento Commerce是提供一流的购物体验，而无需开发人员的支持。 Magento Commerce 和 Magento Open Source存在代码问题漏洞，该漏洞的存在是由于对用户提供的输入验证不足。远程管理员可以向应用程序传递特制的输入，并在系统上执行任意代码。该漏洞允许远程用户在目标系统上执行任意代码。
ソース: CNNVD (China National Vulnerability Database)
CVSS情報
N/A
ソース: CNNVD (China National Vulnerability Database)
脆弱性タイプ
N/A
ソース: CNNVD (China National Vulnerability Database)
影響を受ける製品
| ベンダー | プロダクト | 影響を受けるバージョン | CPE | 購読 |
|---|---|---|---|---|
| Adobe | Magento Commerce | unspecified ~ 2.4.2 | - |
II. CVE-2021-36042の公開POC
| # | POC説明 | ソースリンク | Shenlongリンク |
|---|
AI生成POCプレミアム
公開POCは見つかりませんでした。
ログインしてAI POCを生成III. CVE-2021-36042のインテリジェンス情報
请登录查看更多情报信息。
- https://helpx.adobe.com/security/products/magento/apsb21-64.htmlx_refsource_MISC
- https://nvd.nist.gov/vuln/detail/CVE-2021-36042
Same Patch Batch · Adobe · 2021-09-01 · 60 CVEs total
| CVE-2021-36028 | 9.1 CRITICAL | Magento Commerce XML Injection Vulnerability Could Lead To Remote Code Execution |
| CVE-2021-36035 | 9.1 CRITICAL | Magento Commerce Stock Media Improper Input Validation Could Lead To Remote Code Execution |
| CVE-2021-36025 | 9.1 CRITICAL | Magento Commerce Customer Edition Improper Input Validation Could Lead To Remote Code Exec |
| CVE-2021-36041 | 9.1 CRITICAL | Magento Commerce Improper Input Validation Could Lead To Remote Code Execution |
| CVE-2021-36040 | 9.1 CRITICAL | Magento Commerce Improper Input Validation Could Lead To Remote Code Execution |
| CVE-2021-36033 | 9.1 CRITICAL | Magento Commerce Widgets Module XML Injection Vulnerability Could Lead To Remote Code Exec |
| CVE-2021-36024 | 9.1 CRITICAL | Magento Commerce Improper Neutralization of Special Elements Used In A Command |
| CVE-2021-36034 | 9.1 CRITICAL | Magento Commerce Improper Input Validation Could Lead To Remote Code Execution |
| CVE-2021-36029 | 9.1 CRITICAL | Magento Commerce Improper Authorization Vulnerability Could Lead To Remote Code Execution |
| CVE-2021-36022 | 9.1 CRITICAL | Magento Commerce Widgets Update Layout XML Injection Vulnerability Could Lead To Remote Co |
| CVE-2021-36032 | 8.3 HIGH | Magento Commerce Improper Input Validation Could Lead To Information Exposure and Privileg |
| CVE-2021-36020 | 8.2 HIGH | Magento Commerce XML Injection Vulnerability In The 'City' Field Could Lead To Remote Code |
| CVE-2021-36043 | 8.0 HIGH | Magento Commerce Authenticated Blind SSRF Could Lead To Remote Code Execution |
| CVE-2021-36052 | 7.8 HIGH | XMPToolkit SDK ImportTIFF_CheckStandardMapping Memory Corruption |
| CVE-2021-36059 | 7.8 HIGH | Adobe Bridge Memory Corruption Vulnerability Could Lead to Arbitrary Code Execution |
| CVE-2021-36064 | 7.8 HIGH | XMP Toolkit SDK SVG_Adapter ParseFullNS Buffer Underflow |
| CVE-2021-36049 | 7.8 HIGH | Adobe Bridge Memory Corruption Vulnerability Could Lead to Arbitrary Code Execution |
| CVE-2021-36047 | 7.8 HIGH | XMP Toolkit SDK Improper Input Validation Could Lead To Arbitrary Code Execution |
| CVE-2021-36055 | 7.8 HIGH | XMP Toolkit SDK Use After Free Vulnerability In ReadingXMPNewDOM Could Lead To Arbitrary C |
| CVE-2021-36048 | 7.8 HIGH | XMP Toolkit SDK Improper Input Validation Could Lead To Arbitrary Code Execution |
Showing 20 of 60 CVEs. View all on vendor page →
IV. 関連脆弱性
同じ製品: Magento Commerce
- CVE-2023-38208
Validate Your Inputs | Improper Neutralization of Special El - CVE-2023-38209
Adobe Commerce Incorrect Authorization Security feature bypa - CVE-2023-29297
Admin-to-admin stored XSS via cache poisoning - CVE-2023-29292
Server Side Request Forgery (SSRF) in FedEx carrier integrat - CVE-2023-29296
[Cloud] Customer suspects IDOR vulnerability
同じベンダー: Adobe
- CVE-2026-34632
Photoshop Installer | CWE-427: Uncontrolled Search Path Elem - CVE-2026-27297
Adobe Framemaker | Integer Underflow (Wrap or Wraparound) (C - CVE-2026-27300
Adobe Framemaker | Access of Uninitialized Pointer (CWE-824) - CVE-2026-27296
Adobe Framemaker | Integer Underflow (Wrap or Wraparound) (C - CVE-2026-27290
Adobe Framemaker | Untrusted Search Path (CWE-426)
V. CVE-2021-36042へのコメント
まだコメントはありません