CVE-2021-28584

Summary

Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are affected by a Path Traversal vulnerability when creating a store with child theme.Successful exploitation could lead to arbitrary file system write by an authenticated attacker. Access to the admin console is required for successful exploitation.

Affected Software

VendorProductVersion RangeStatus
AdobeMagento Commerceunspecified <= 2.4.2affected
AdobeMagento Commerceunspecified <= 2.3.6-p1affected
AdobeMagento Commerceunspecified <= 2.4.1-p1affected
AdobeMagento Commerceunspecified <= Noneaffected

Weaknesses

  • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CWE-22)

ADP Enrichment

CVE Program Container

Additional References

References