CVE-2021-28584 MEDIUM

CVE-2021-28584: Magento Commerce path traversal vulnerability in child theme store creation

Vendor Adobe
Product Magento Commerce
Weakness CWE-22 · Path traversal
Published June 28, 2021
Last update September 16, 2024

CVSS base score

5.4/10
Attack vector Network
Attack complexity Low
Privileges required Low
User interaction None
Confidentiality None
Integrity Low

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L

What the vulnerability does

Description

Magento versions 2.4.2 (and earlier), 2.4.1-p1 (and earlier) and 2.3.6-p1 (and earlier) are affected by a Path Traversal vulnerability when creating a store with child theme.Successful exploitation could lead to arbitrary file system write by an authenticated attacker. Access to the admin console is required for successful exploitation.

Key dates

Disclosure timeline

June 28, 2021 CVE published
September 16, 2024 Record updated