{"answers":{"affected":"2 open source packages ship an affected version, including @scandipwa/magento-scripts. It affects 1 product.","exploited":"There is no known exploitation of CVE-2021-32684 in the wild and no public exploit code.","fix":"Upgrade @scandipwa/magento-scripts to 1.5.3 or later.","what":"CVE-2021-32684 is a medium-severity denial of service vulnerability in scandipwa create-magento-app, published on 14 Jun 2021. It can only be exploited from the same machine or local network, with no action from the victim."},"fix_prompt":"Check this codebase for CVE-2021-32684 and fix it if it is affected.\n\nWhat it is: CVE-2021-32684 is a medium-severity denial of service vulnerability in scandipwa create-magento-app, published on 14 Jun 2021. It can only be exploited from the same machine or local network, with no action from the victim.\nExploitation: There is no known exploitation of CVE-2021-32684 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- @scandipwa/magento-scripts (npm): affected from 1.5.1; fixed in 1.5.3\n- @scandipwa/magento-scripts (npm): affected from 1.5.1; fixed in 1.5.3\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2021-32684/ (Markdown: https://insights.sbomify.com/CVE-2021-32684/index.md)","id":"CVE-2021-32684","markdown":"https://insights.sbomify.com/CVE-2021-32684/index.md","name":"CVE-2021-32684","record":{"aliases":["GHSA-52qp-gwwh-qrg4"],"analysis":{"component_type":"developer_tool","fix_type":"upgrade","impacts":["denial_of_service"],"network_reachable":"adjacent_or_local","non_default_config":false,"product_category":"Magento deployment tool","requires_auth":"none","summary":"Missing error handlers in Magento deployment scripts cause commands to fail, resulting in a denial of service for users of the tool.","user_interaction":"not_required","vuln_class":"denial_of_service"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"GitHub_M","cpe":[{"product":"magento-scripts","vendor":"scandipwa"}],"cvss":{"score":6.2,"severity":"medium","source":"cna","vector":"CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"cwes":[{"id":"CWE-670","name":"Always-Incorrect Control Flow Implementation"}],"description":"magento-scripts contains scripts and configuration used by Create Magento App, a zero-configuration tool-chain which allows one to deploy Magento 2. In versions 1.5.1 and 1.5.2, after changing the function from synchronous to asynchronous there wasn't implemented handler in the start, stop, exec, and logs commands, effectively making them unusable. Version 1.5.3 contains patches for the problems.","ecosystems":["npm"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"Missing Handler in @scandipwa/magento-scripts","id":"CVE-2021-32684","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"npm","product":null,"products":[],"type":"denial_of_service","year":"2021"},"n_packages":2,"n_references":2,"next":{"headline":"Improper Verification of Cryptographic Signature in tenvoy","id":"CVE-2021-32685"},"packages":[{"ecosystem":"npm","fixed":["1.5.3"],"introduced":["1.5.1"],"last_affected":[],"package":"@scandipwa/magento-scripts","purl":null,"source":"GHSA-52qp-gwwh-qrg4"},{"ecosystem":"npm","fixed":["1.5.3"],"introduced":["1.5.1"],"last_affected":[],"package":"@scandipwa/magento-scripts","purl":"pkg:npm/%40scandipwa/magento-scripts","source":"GHSA-52qp-gwwh-qrg4"}],"prev":{"headline":"XSS through createObjectURL","id":"CVE-2021-32683"},"products":["create-magento-app"],"published":"2021-06-14","related":[],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2024-08-03","vendors":["scandipwa"]},"summary":"Missing error handlers in Magento deployment scripts cause commands to fail, resulting in a denial of service for users of the tool.","url":"https://insights.sbomify.com/CVE-2021-32684/"}