Publish Advisories

GHSA-rv48-v862-mp92 GHSA-rv48-v862-mp92
2026-05-22 18:04:22 -07:00 · 2024-01-10 19:02:13 +00:00
parent 9a074e577a
commit 03d04938e5
2 changed files with 80 additions and 35 deletions
@@ -0,0 +1,80 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-rv48-v862-mp92",
+  "modified": "2024-01-10T19:00:53Z",
+  "published": "2022-05-24T17:41:55Z",
+  "aliases": [
+    "CVE-2021-21018"
+  ],
+  "summary": "Magento OS Command Injection",
+  "details": "Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to OS command injection via the scheduled operation module. Successful exploitation could lead to arbitrary code execution by an authenticated attacker. Access to the admin console is required for successful exploitation.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "magento/community-edition"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "2.3.6"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "magento/community-edition"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "2.4.0"
+            },
+            {
+              "fixed": "2.4.1-p1"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21018"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/magento/magento2"
+    },
+    {
+      "type": "WEB",
+      "url": "https://helpx.adobe.com/security/products/magento/apsb21-08.html"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-78"
+    ],
+    "severity": "CRITICAL",
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-01-10T19:00:53Z",
+    "nvd_published_at": "2021-02-11T20:15:00Z"
+  }
+}
@@ -1,35 +0,0 @@
-{
-  "schema_version": "1.4.0",
-  "id": "GHSA-rv48-v862-mp92",
-  "modified": "2022-05-24T17:41:55Z",
-  "published": "2022-05-24T17:41:55Z",
-  "aliases": [
-    "CVE-2021-21018"
-  ],
-  "details": "Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to OS command injection via the scheduled operation module. Successful exploitation could lead to arbitrary code execution by an authenticated attacker. Access to the admin console is required for successful exploitation.",
-  "severity": [
-
-  ],
-  "affected": [
-
-  ],
-  "references": [
-    {
-      "type": "ADVISORY",
-      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21018"
-    },
-    {
-      "type": "WEB",
-      "url": "https://helpx.adobe.com/security/products/magento/apsb21-08.html"
-    }
-  ],
-  "database_specific": {
-    "cwe_ids": [
-      "CWE-78"
-    ],
-    "severity": "CRITICAL",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
-    "nvd_published_at": "2021-02-11T20:15:00Z"
-  }
-}