CVE-2021-21015 in Magento and Adobe Products
Published on February 11, 2021

Magento Commerce Unauthorized Data Modification Could Lead to Arbitrary Code Execution

Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to an OS command injection via the customer attribute save controller. Successful exploitation could lead to arbitrary code execution by an authenticated attacker. Access to the admin console is required for successful exploitation.

NVD

Weakness Type

What is a Shell injection Vulnerability?

The software constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

CVE-2021-21015 has been classified to as a Shell injection vulnerability or weakness.

Products Associated with CVE-2021-21015

stack.watch emails you whenever new vulnerabilities are published in Magento or Adobe Magento Commerce. Just hit a watch button to start following.

Magento

Adobe Magento Commerce

Affected Versions

Adobe Magento Commerce:

Version unspecified, <= 2.4.1 is affected.
Version unspecified, <= 2.4.0-p1 is affected.
Version unspecified, <= 2.3.6 is affected.
Version unspecified, <= None is affected.

Exploit Probability

EPSS

4.86%

Percentile

89.36%