Skip to content

Commit fd56d8e

Browse files
advisory-database[bot]advisory-database[bot]
committed
Publish Advisories
GHSA-2pq5-gpqf-g4r3 GHSA-36xq-7w8w-xp68 GHSA-6cwv-wj7v-73xp GHSA-mx5m-j5xr-jg8c GHSA-wr57-3h2f-3q95 GHSA-2pq5-gpqf-g4r3 GHSA-36xq-7w8w-xp68 GHSA-6cwv-wj7v-73xp GHSA-mx5m-j5xr-jg8c GHSA-wr57-3h2f-3q95
1 parent e6004b2 commit fd56d8e

10 files changed

Lines changed: 581 additions & 160 deletions

File tree

‎advisories/github-reviewed/2022/05/GHSA-2pq5-gpqf-g4r3/GHSA-2pq5-gpqf-g4r3.json‎

Lines changed: 117 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,117 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-2pq5-gpqf-g4r3",
4+
"modified": "2025-11-07T23:26:39Z",
5+
"published": "2022-05-24T19:12:46Z",
6+
"aliases": [
7+
"CVE-2021-36040"
8+
],
9+
"summary": "Magento has a file extension restrictions bypass",
10+
"details": "Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability. An attacker with admin privileges can upload a specially crafted file to bypass file extension restrictions and could lead to remote code execution.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Packagist",
21+
"name": "magento/project-community-edition"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"last_affected": "2.0.2"
32+
}
33+
]
34+
}
35+
]
36+
},
37+
{
38+
"package": {
39+
"ecosystem": "Packagist",
40+
"name": "magento/community-edition"
41+
},
42+
"versions": [
43+
"2.4.2"
44+
]
45+
},
46+
{
47+
"package": {
48+
"ecosystem": "Packagist",
49+
"name": "magento/community-edition"
50+
},
51+
"ranges": [
52+
{
53+
"type": "ECOSYSTEM",
54+
"events": [
55+
{
56+
"introduced": "2.4.2-p1"
57+
},
58+
{
59+
"fixed": "2.4.2-p2"
60+
}
61+
]
62+
}
63+
]
64+
},
65+
{
66+
"package": {
67+
"ecosystem": "Packagist",
68+
"name": "magento/community-edition"
69+
},
70+
"versions": [
71+
"2.3.7"
72+
]
73+
},
74+
{
75+
"package": {
76+
"ecosystem": "Packagist",
77+
"name": "magento/community-edition"
78+
},
79+
"ranges": [
80+
{
81+
"type": "ECOSYSTEM",
82+
"events": [
83+
{
84+
"introduced": "0"
85+
},
86+
{
87+
"fixed": "2.3.7-p1"
88+
}
89+
]
90+
}
91+
]
92+
}
93+
],
94+
"references": [
95+
{
96+
"type": "ADVISORY",
97+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-36040"
98+
},
99+
{
100+
"type": "PACKAGE",
101+
"url": "https://github.com/magento/magento2"
102+
},
103+
{
104+
"type": "WEB",
105+
"url": "https://helpx.adobe.com/security/products/magento/apsb21-64.html"
106+
}
107+
],
108+
"database_specific": {
109+
"cwe_ids": [
110+
"CWE-20"
111+
],
112+
"severity": "CRITICAL",
113+
"github_reviewed": true,
114+
"github_reviewed_at": "2025-11-07T23:26:39Z",
115+
"nvd_published_at": "2021-09-01T15:15:00Z"
116+
}
117+
}

‎advisories/github-reviewed/2022/05/GHSA-36xq-7w8w-xp68/GHSA-36xq-7w8w-xp68.json‎

Lines changed: 117 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,117 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-36xq-7w8w-xp68",
4+
"modified": "2025-11-07T23:27:42Z",
5+
"published": "2022-05-24T19:12:46Z",
6+
"aliases": [
7+
"CVE-2021-36043"
8+
],
9+
"summary": "Magento affected by a blind SSRF vulnerability in the bundled dotmailer extension",
10+
"details": "Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by a blind SSRF vulnerability in the bundled dotmailer extension. An attacker with admin privileges could abuse this to achieve remote code execution should Redis be enabled.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Packagist",
21+
"name": "magento/project-community-edition"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"last_affected": "2.0.2"
32+
}
33+
]
34+
}
35+
]
36+
},
37+
{
38+
"package": {
39+
"ecosystem": "Packagist",
40+
"name": "magento/community-edition"
41+
},
42+
"ranges": [
43+
{
44+
"type": "ECOSYSTEM",
45+
"events": [
46+
{
47+
"introduced": "0"
48+
},
49+
{
50+
"fixed": "2.3.7-p1"
51+
}
52+
]
53+
}
54+
]
55+
},
56+
{
57+
"package": {
58+
"ecosystem": "Packagist",
59+
"name": "magento/community-edition"
60+
},
61+
"versions": [
62+
"2.3.7"
63+
]
64+
},
65+
{
66+
"package": {
67+
"ecosystem": "Packagist",
68+
"name": "magento/community-edition"
69+
},
70+
"ranges": [
71+
{
72+
"type": "ECOSYSTEM",
73+
"events": [
74+
{
75+
"introduced": "2.4.2-p1"
76+
},
77+
{
78+
"fixed": "2.4.2-p2"
79+
}
80+
]
81+
}
82+
]
83+
},
84+
{
85+
"package": {
86+
"ecosystem": "Packagist",
87+
"name": "magento/community-edition"
88+
},
89+
"versions": [
90+
"2.4.2"
91+
]
92+
}
93+
],
94+
"references": [
95+
{
96+
"type": "ADVISORY",
97+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-36043"
98+
},
99+
{
100+
"type": "PACKAGE",
101+
"url": "https://github.com/magento/magento2"
102+
},
103+
{
104+
"type": "WEB",
105+
"url": "https://helpx.adobe.com/security/products/magento/apsb21-64.html"
106+
}
107+
],
108+
"database_specific": {
109+
"cwe_ids": [
110+
"CWE-918"
111+
],
112+
"severity": "HIGH",
113+
"github_reviewed": true,
114+
"github_reviewed_at": "2025-11-07T23:27:42Z",
115+
"nvd_published_at": "2021-09-01T15:15:00Z"
116+
}
117+
}

‎advisories/github-reviewed/2022/05/GHSA-6cwv-wj7v-73xp/GHSA-6cwv-wj7v-73xp.json‎

Lines changed: 117 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,117 @@
1+
{
2+
"schema_version": "1.4.0",
3+
"id": "GHSA-6cwv-wj7v-73xp",
4+
"modified": "2025-11-07T23:27:50Z",
5+
"published": "2022-05-24T19:12:46Z",
6+
"aliases": [
7+
"CVE-2021-36042"
8+
],
9+
"summary": "Magento executes code via the API File Option Upload Extension",
10+
"details": "Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an improper input validation vulnerability in the API File Option Upload Extension. An attacker with Admin privileges can achieve unrestricted file upload which can result in remote code execution.",
11+
"severity": [
12+
{
13+
"type": "CVSS_V3",
14+
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"
15+
}
16+
],
17+
"affected": [
18+
{
19+
"package": {
20+
"ecosystem": "Packagist",
21+
"name": "magento/project-community-edition"
22+
},
23+
"ranges": [
24+
{
25+
"type": "ECOSYSTEM",
26+
"events": [
27+
{
28+
"introduced": "0"
29+
},
30+
{
31+
"last_affected": "2.0.2"
32+
}
33+
]
34+
}
35+
]
36+
},
37+
{
38+
"package": {
39+
"ecosystem": "Packagist",
40+
"name": "magento/community-edition"
41+
},
42+
"versions": [
43+
"2.4.2"
44+
]
45+
},
46+
{
47+
"package": {
48+
"ecosystem": "Packagist",
49+
"name": "magento/community-edition"
50+
},
51+
"ranges": [
52+
{
53+
"type": "ECOSYSTEM",
54+
"events": [
55+
{
56+
"introduced": "2.4.2-p1"
57+
},
58+
{
59+
"fixed": "2.4.2-p2"
60+
}
61+
]
62+
}
63+
]
64+
},
65+
{
66+
"package": {
67+
"ecosystem": "Packagist",
68+
"name": "magento/community-edition"
69+
},
70+
"versions": [
71+
"2.3.7"
72+
]
73+
},
74+
{
75+
"package": {
76+
"ecosystem": "Packagist",
77+
"name": "magento/community-edition"
78+
},
79+
"ranges": [
80+
{
81+
"type": "ECOSYSTEM",
82+
"events": [
83+
{
84+
"introduced": "0"
85+
},
86+
{
87+
"fixed": "2.3.7-p1"
88+
}
89+
]
90+
}
91+
]
92+
}
93+
],
94+
"references": [
95+
{
96+
"type": "ADVISORY",
97+
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-36042"
98+
},
99+
{
100+
"type": "PACKAGE",
101+
"url": "https://github.com/magento/magento2"
102+
},
103+
{
104+
"type": "WEB",
105+
"url": "https://helpx.adobe.com/security/products/magento/apsb21-64.html"
106+
}
107+
],
108+
"database_specific": {
109+
"cwe_ids": [
110+
"CWE-20"
111+
],
112+
"severity": "CRITICAL",
113+
"github_reviewed": true,
114+
"github_reviewed_at": "2025-11-07T23:27:50Z",
115+
"nvd_published_at": "2021-09-01T15:15:00Z"
116+
}
117+
}

0 commit comments

Comments
 (0)