CVE-2021-36028 Magento Commerce XML Injection Vulnerability Could Lead To Remote Code Execution

What is CVE-2021-36028?

CVE-2021-36028 is a critical vulnerability in Adobe Magento Commerce, published on 1 Sep 2021. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability when saving a configurable product. An attacker with admin privileges can trigger a specially crafted script to achieve remote code execution.

Weakness: CWE-91

Which versions are affected by CVE-2021-36028?

8 open source packages ship an affected version, including magento/community-edition and magento/project-community-edition. It affects 2 products.

Products include Adobe Adobe Commerce, Adobe Magento Open Source.

How do I fix CVE-2021-36028?

Upgrade magento/community-edition to a fixed version for your release line: 2.3.7-p1 or 2.4.2-p2.

Is CVE-2021-36028 being exploited?

There is no known exploitation of CVE-2021-36028 in the wild and no public exploit code.

Other vulnerabilities in Adobe Magento Commerce

• CVE-2021-36022 Magento Commerce Widgets Update Layout XML Injection Vulnerability Could Lead To Remote Code Execution Critical 9.1
• CVE-2021-36024 Magento Commerce Improper Neutralization of Special Elements Used In A Command Critical 9.1
• CVE-2021-36025 Magento Commerce Customer Edition Improper Input Validation Could Lead To Remote Code Execution Critical 9.1
• CVE-2021-36029 Magento Commerce Improper Authorization Vulnerability Could Lead To Remote Code Execution Critical 9.1
• CVE-2021-36033 Magento Commerce Widgets Module XML Injection Vulnerability Could Lead To Remote Code Execution Critical 9.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-5pjj-7fq8-9gpf.