Advisory details:
github_osv / GHSA-xvpx-6hh8-7h72
| Advisory ID | github_osv/GHSA-xvpx-6hh8-7h72 |
| Aliases |
CVE-2021-36020
|
| Summary | Magento XML Injection vulnerability in the 'City' field Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability in the 'City' field. An unauthenticated attacker can trigger a specially crafted script to achieve remote code execution. |
| Status | Published |
| Exploitability | 0.5 |
| Weighted Severity | 0.0 |
| Risk | |
| Affected and Fixed Packages | Package Details |
| Introduced and Fixed Package Commit Patches | Package Commit Patches Details |
| System | Score | Found at |
|---|---|---|
| generic_textual | HIGH |
| Reference id | Reference type | URL |
|---|---|---|
| https://github.com/magento/magento2 | ||
| apsb21-64.html | Advisory | https://helpx.adobe.com/security/products/magento/apsb21-64.html |
| CVE-2021-36020 | https://nvd.nist.gov/vuln/detail/CVE-2021-36020 |
No EPSS data available for this advisory.
| Patch URL | |
|---|---|
| There are no known patches. | |
There are no SSVC decisions available.