diff --git a/advisories/github-reviewed/2022/05/GHSA-rv48-v862-mp92/GHSA-rv48-v862-mp92.json b/advisories/github-reviewed/2022/05/GHSA-rv48-v862-mp92/GHSA-rv48-v862-mp92.json new file mode 100644 index 00000000000..3a54d8f289c --- /dev/null +++ b/advisories/github-reviewed/2022/05/GHSA-rv48-v862-mp92/GHSA-rv48-v862-mp92.json @@ -0,0 +1,80 @@ +{ + "schema_version": "1.4.0", + "id": "GHSA-rv48-v862-mp92", + "modified": "2024-01-10T19:00:53Z", + "published": "2022-05-24T17:41:55Z", + "aliases": [ + "CVE-2021-21018" + ], + "summary": "Magento OS Command Injection", + "details": "Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to OS command injection via the scheduled operation module. Successful exploitation could lead to arbitrary code execution by an authenticated attacker. Access to the admin console is required for successful exploitation.", + "severity": [ + { + "type": "CVSS_V3", + "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H" + } + ], + "affected": [ + { + "package": { + "ecosystem": "Packagist", + "name": "magento/community-edition" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "0" + }, + { + "fixed": "2.3.6" + } + ] + } + ] + }, + { + "package": { + "ecosystem": "Packagist", + "name": "magento/community-edition" + }, + "ranges": [ + { + "type": "ECOSYSTEM", + "events": [ + { + "introduced": "2.4.0" + }, + { + "fixed": "2.4.1-p1" + } + ] + } + ] + } + ], + "references": [ + { + "type": "ADVISORY", + "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21018" + }, + { + "type": "PACKAGE", + "url": "https://github.com/magento/magento2" + }, + { + "type": "WEB", + "url": "https://helpx.adobe.com/security/products/magento/apsb21-08.html" + } + ], + "database_specific": { + "cwe_ids": [ + "CWE-78" + ], + "severity": "CRITICAL", + "github_reviewed": true, + "github_reviewed_at": "2024-01-10T19:00:53Z", + "nvd_published_at": "2021-02-11T20:15:00Z" + } +} \ No newline at end of file diff --git a/advisories/unreviewed/2022/05/GHSA-rv48-v862-mp92/GHSA-rv48-v862-mp92.json b/advisories/unreviewed/2022/05/GHSA-rv48-v862-mp92/GHSA-rv48-v862-mp92.json deleted file mode 100644 index f559418cf03..00000000000 --- a/advisories/unreviewed/2022/05/GHSA-rv48-v862-mp92/GHSA-rv48-v862-mp92.json +++ /dev/null @@ -1,35 +0,0 @@ -{ - "schema_version": "1.4.0", - "id": "GHSA-rv48-v862-mp92", - "modified": "2022-05-24T17:41:55Z", - "published": "2022-05-24T17:41:55Z", - "aliases": [ - "CVE-2021-21018" - ], - "details": "Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to OS command injection via the scheduled operation module. Successful exploitation could lead to arbitrary code execution by an authenticated attacker. Access to the admin console is required for successful exploitation.", - "severity": [ - - ], - "affected": [ - - ], - "references": [ - { - "type": "ADVISORY", - "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21018" - }, - { - "type": "WEB", - "url": "https://helpx.adobe.com/security/products/magento/apsb21-08.html" - } - ], - "database_specific": { - "cwe_ids": [ - "CWE-78" - ], - "severity": "CRITICAL", - "github_reviewed": false, - "github_reviewed_at": null, - "nvd_published_at": "2021-02-11T20:15:00Z" - } -} \ No newline at end of file