CVE-2021-36033 Magento Commerce Widgets Module XML Injection Vulnerability Could Lead To Remote Code Execution

What is CVE-2021-36033?

CVE-2021-36033 is a critical vulnerability in Adobe Magento Commerce, published on 1 Sep 2021. An attacker needs administrator access to exploit it, with no action from the victim.

Official description

Magento Commerce versions 2.4.2 (and earlier), 2.4.2-p1 (and earlier) and 2.3.7 (and earlier) are affected by an XML Injection vulnerability in the Widgets Module. An attacker with admin privileges can trigger a specially crafted script to achieve remote code execution.

Weakness: CWE-91

Which versions are affected by CVE-2021-36033?

8 open source packages ship an affected version, including magento/community-edition and magento/project-community-edition. It affects 2 products.

Products include Adobe Adobe Commerce, Adobe Magento Open Source.

How do I fix CVE-2021-36033?

Upgrade magento/community-edition to a fixed version for your release line: 2.3.7-p1 or 2.4.2-p2.

Is CVE-2021-36033 being exploited?

There is no known exploitation of CVE-2021-36033 in the wild and no public exploit code.

Other vulnerabilities in Adobe Magento Commerce

• CVE-2021-36022 Magento Commerce Widgets Update Layout XML Injection Vulnerability Could Lead To Remote Code Execution Critical 9.1
• CVE-2021-36024 Magento Commerce Improper Neutralization of Special Elements Used In A Command Critical 9.1
• CVE-2021-36025 Magento Commerce Customer Edition Improper Input Validation Could Lead To Remote Code Execution Critical 9.1
• CVE-2021-36028 Magento Commerce XML Injection Vulnerability Could Lead To Remote Code Execution Critical 9.1
• CVE-2021-36029 Magento Commerce Improper Authorization Vulnerability Could Lead To Remote Code Execution Critical 9.1

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-p746-qw73-qmmx.