magento magento CVE-2021-21025 in Magento and Adobe Products
Published on February 11, 2021

Magento Commerce XML Injection Could Lead To Arbitrary Code Execution

product logo product logo
Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to XML injection in the product layout updates. Successful exploitation could lead to arbitrary code execution by an authenticated attacker. Access to the admin console is required for successful exploitation.

NVD

Weakness Type

What is an aka Blind XPath Injection Vulnerability?

The software does not properly neutralize special elements that are used in XML, allowing attackers to modify the syntax, content, or commands of the XML before it is processed by an end system. Within XML, special elements could include reserved words or characters such as "<", ">", """, and "&", which could then be used to add new data or modify XML syntax.

CVE-2021-21025 has been classified to as an aka Blind XPath Injection vulnerability or weakness.


Products Associated with CVE-2021-21025

stack.watch emails you whenever new vulnerabilities are published in Magento or Adobe Magento Commerce. Just hit a watch button to start following.

Magento
 
Adobe Magento Commerce
 

Affected Versions

Adobe Magento Commerce:

Exploit Probability

EPSS
4.72%
Percentile
89.24%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.