CVE-2021-21014 in Magento and Adobe Products
Published on February 11, 2021

Magento Commerce Arbitrary Folder Empty Could Lead To Arbitrary Code Execution

Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to a file upload restriction bypass. Successful exploitation could lead to arbitrary code execution by an authenticated attacker. Access to the admin console is required for successful exploitation.

NVD

Weakness Type

What is an Unrestricted File Upload Vulnerability?

The software allows the attacker to upload or transfer files of dangerous types that can be automatically processed within the product's environment.

CVE-2021-21014 has been classified to as an Unrestricted File Upload vulnerability or weakness.

Products Associated with CVE-2021-21014

stack.watch emails you whenever new vulnerabilities are published in Magento or Adobe Magento Commerce. Just hit a watch button to start following.

Magento

Adobe Magento Commerce

Affected Versions

Adobe Magento Commerce:

Version unspecified, <= 2.4.1 is affected.
Version unspecified, <= 2.4.0-p1 is affected.
Version unspecified, <= 2.3.6 is affected.
Version unspecified, <= None is affected.

Exploit Probability

EPSS

0.51%

Percentile

65.84%