From 03d04938e5432d6488e7cec97b67ba116d218dff Mon Sep 17 00:00:00 2001
From: "advisory-database[bot]"
 <45398580+advisory-database[bot]@users.noreply.github.com>
Date: Wed, 10 Jan 2024 19:02:13 +0000
Subject: [PATCH] Publish Advisories

GHSA-rv48-v862-mp92
GHSA-rv48-v862-mp92
---
 .../GHSA-rv48-v862-mp92.json                  | 80 +++++++++++++++++++
 .../GHSA-rv48-v862-mp92.json                  | 35 --------
 2 files changed, 80 insertions(+), 35 deletions(-)
 create mode 100644 advisories/github-reviewed/2022/05/GHSA-rv48-v862-mp92/GHSA-rv48-v862-mp92.json
 delete mode 100644 advisories/unreviewed/2022/05/GHSA-rv48-v862-mp92/GHSA-rv48-v862-mp92.json

diff --git a/advisories/github-reviewed/2022/05/GHSA-rv48-v862-mp92/GHSA-rv48-v862-mp92.json b/advisories/github-reviewed/2022/05/GHSA-rv48-v862-mp92/GHSA-rv48-v862-mp92.json
new file mode 100644
index 00000000000..3a54d8f289c
--- /dev/null
+++ b/advisories/github-reviewed/2022/05/GHSA-rv48-v862-mp92/GHSA-rv48-v862-mp92.json
@@ -0,0 +1,80 @@
+{
+  "schema_version": "1.4.0",
+  "id": "GHSA-rv48-v862-mp92",
+  "modified": "2024-01-10T19:00:53Z",
+  "published": "2022-05-24T17:41:55Z",
+  "aliases": [
+    "CVE-2021-21018"
+  ],
+  "summary": "Magento OS Command Injection",
+  "details": "Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to OS command injection via the scheduled operation module. Successful exploitation could lead to arbitrary code execution by an authenticated attacker. Access to the admin console is required for successful exploitation.",
+  "severity": [
+    {
+      "type": "CVSS_V3",
+      "score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H"
+    }
+  ],
+  "affected": [
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "magento/community-edition"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "0"
+            },
+            {
+              "fixed": "2.3.6"
+            }
+          ]
+        }
+      ]
+    },
+    {
+      "package": {
+        "ecosystem": "Packagist",
+        "name": "magento/community-edition"
+      },
+      "ranges": [
+        {
+          "type": "ECOSYSTEM",
+          "events": [
+            {
+              "introduced": "2.4.0"
+            },
+            {
+              "fixed": "2.4.1-p1"
+            }
+          ]
+        }
+      ]
+    }
+  ],
+  "references": [
+    {
+      "type": "ADVISORY",
+      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21018"
+    },
+    {
+      "type": "PACKAGE",
+      "url": "https://github.com/magento/magento2"
+    },
+    {
+      "type": "WEB",
+      "url": "https://helpx.adobe.com/security/products/magento/apsb21-08.html"
+    }
+  ],
+  "database_specific": {
+    "cwe_ids": [
+      "CWE-78"
+    ],
+    "severity": "CRITICAL",
+    "github_reviewed": true,
+    "github_reviewed_at": "2024-01-10T19:00:53Z",
+    "nvd_published_at": "2021-02-11T20:15:00Z"
+  }
+}
\ No newline at end of file
diff --git a/advisories/unreviewed/2022/05/GHSA-rv48-v862-mp92/GHSA-rv48-v862-mp92.json b/advisories/unreviewed/2022/05/GHSA-rv48-v862-mp92/GHSA-rv48-v862-mp92.json
deleted file mode 100644
index f559418cf03..00000000000
--- a/advisories/unreviewed/2022/05/GHSA-rv48-v862-mp92/GHSA-rv48-v862-mp92.json
+++ /dev/null
@@ -1,35 +0,0 @@
-{
-  "schema_version": "1.4.0",
-  "id": "GHSA-rv48-v862-mp92",
-  "modified": "2022-05-24T17:41:55Z",
-  "published": "2022-05-24T17:41:55Z",
-  "aliases": [
-    "CVE-2021-21018"
-  ],
-  "details": "Magento versions 2.4.1 (and earlier), 2.4.0-p1 (and earlier) and 2.3.6 (and earlier) are vulnerable to OS command injection via the scheduled operation module. Successful exploitation could lead to arbitrary code execution by an authenticated attacker. Access to the admin console is required for successful exploitation.",
-  "severity": [
-
-  ],
-  "affected": [
-
-  ],
-  "references": [
-    {
-      "type": "ADVISORY",
-      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-21018"
-    },
-    {
-      "type": "WEB",
-      "url": "https://helpx.adobe.com/security/products/magento/apsb21-08.html"
-    }
-  ],
-  "database_specific": {
-    "cwe_ids": [
-      "CWE-78"
-    ],
-    "severity": "CRITICAL",
-    "github_reviewed": false,
-    "github_reviewed_at": null,
-    "nvd_published_at": "2021-02-11T20:15:00Z"
-  }
-}
\ No newline at end of file