Description

Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to OS command injection via the WebAPI. Successful exploitation could lead to remote code execution by an authenticated attacker. Access to the admin console is required for successful exploitation.

Remediation

References

CVE-2021-21016

Related Vulnerabilities

WordPress Plugin Yoast SEO Cross-Site Scripting (2.0.1)

Django URL Redirection to Untrusted Site ('Open Redirect') Vulnerability (CVE-2017-7234)

WordPress Plugin Membership Simplified Multiple SQL Injection Vulnerabilities (1.58)

WordPress Plugin WordPress Social Share, Social Login and Social Comments-Super Socializer Multiple Cross-Site Scripting Vulnerabilities (7.8.9)

WordPress Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') Vulnerability (CVE-2008-4769)

Severity

Critical

Classification

CVE-2021-21016 CWE-138 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Tags

Missing Update Known Vulnerabilities