CVE-2021-36020 Magento Commerce XML Injection Vulnerability In The 'City' Field Could Lead To Remote Code Execution

What is CVE-2021-36020?

CVE-2021-36020 is a high-severity vulnerability in Adobe Magento Commerce, published on 1 Sep 2021. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability in the 'City' field. An unauthenticated attacker can trigger a specially crafted script to achieve remote code execution.

Weakness: CWE-91

Which versions are affected by CVE-2021-36020?

8 open source packages ship an affected version, including magento/community-edition and magento/project-community-edition. It affects 2 products.

Products include Adobe Adobe Commerce, Adobe Magento Open Source.

How do I fix CVE-2021-36020?

Upgrade magento/community-edition to a fixed version for your release line: 2.3.7-p1 or 2.4.2-p2.

Is CVE-2021-36020 being exploited?

There is no known exploitation of CVE-2021-36020 in the wild and no public exploit code.

Other vulnerabilities in Adobe Magento Commerce

• CVE-2021-36022 Magento Commerce Widgets Update Layout XML Injection Vulnerability Could Lead To Remote Code Execution Critical 9.1
• CVE-2021-36024 Magento Commerce Improper Neutralization of Special Elements Used In A Command Critical 9.1
• CVE-2021-36025 Magento Commerce Customer Edition Improper Input Validation Could Lead To Remote Code Execution Critical 9.1
• CVE-2021-36028 Magento Commerce XML Injection Vulnerability Could Lead To Remote Code Execution Critical 9.1
• CVE-2021-36029 Magento Commerce Improper Authorization Vulnerability Could Lead To Remote Code Execution Critical 9.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-xvpx-6hh8-7h72.