Advisory details:
github_osv / GHSA-w2p4-2c8c-2g7h
| Advisory ID | github_osv/GHSA-w2p4-2c8c-2g7h |
| Aliases |
CVE-2021-21015
|
| Summary | Magento OS command injection via the customer attribute save controller Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to an OS command injection via the customer attribute save controller. Successful exploitation could lead to arbitrary code execution by an authenticated attacker. Access to the admin console is required for successful exploitation. |
| Status | Published |
| Exploitability | 0.5 |
| Weighted Severity | 7.2 |
| Risk | 3.6 |
| Affected and Fixed Packages | Package Details |
| Introduced and Fixed Package Commit Patches | Package Commit Patches Details |
| System | Score | Found at |
|---|---|---|
| cvssv3.1 | 8.0 | https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2022/05/GHSA-w2p4-2c8c-2g7h/GHSA-w2p4-2c8c-2g7h.json |
| generic_textual | HIGH |
No EPSS data available for this advisory.
| Patch URL | |
|---|---|
| There are no known patches. | |
| Attack Vector (AV) | Attack Complexity (AC) | Privileges Required (PR) | User Interaction (UI) | Scope (S) | Confidentiality Impact (C) | Integrity Impact (I) | Availability Impact (A) |
|---|---|---|---|---|---|---|---|
network adjacent_network local physical |
low high |
none low high |
none required |
unchanged changed |
high low none |
high low none |
high low none |
There are no SSVC decisions available.